f8bb64dedf98df9cb957233dd38a56028285175470c8f62757351d2ef76f76e9

Analysis

max time kernel
150s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Size 1.8MB
Sample260420-bcf2aaaz2z
SHA256 f8bb64dedf98df9cb957233dd38a56028285175470c8f62757351d2ef76f76e9
MD5 c5b9d9eef19ff94518f3ed2540fb4e97
SHA1 45fd555225ce8e4f0655f22918e7149e6c06fd97
SHA512 5ecf0083c010e384c387376d43b2ca2a622faff595340829f6c2b4078cfb6b55ae0c3df1d73996457bbddcf303b49152231ca74ec3d3555a1759a204bee0490b
SSDEEP 49152:5WJE2ZctEafitmGYj+uYP4D2VPrXt7UP9Fq4n:OE2ZBaqaj+uYP4srd7Ai4n
TLSH
T19195231076D2C4B5E6F71A716DA8C5A00EF9FC601E398AEF134479296F74980E438FA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 14 IoCs

pid	Process
5412	alg.exe
4820	DiagnosticsHub.StandardCollector.Service.exe
5416	fxssvc.exe
5300	elevation_service.exe
3268	elevation_service.exe
4968	maintenanceservice.exe
5720	msdtc.exe
5272	OSE.EXE
776	PerceptionSimulationService.exe
6132	perfhost.exe
5724	locator.exe
5460	SensorDataService.exe
5604	snmptrap.exe
5792	spectrum.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\574130c98b62accd.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\GoogleUpdateHelper.msi	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\goopdateres_el.dll	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\goopdateres_it.dll	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\goopdateres_hi.dll	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\GoogleUpdateSetup.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\goopdateres_fi.dll	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMED5D.tmp\goopdateres_iw.dll	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5196	2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
Token: SeAuditPrivilege	5416	fxssvc.exe
Token: SeDebugPrivilege	5412	alg.exe
Token: SeDebugPrivilege	5412	alg.exe
Token: SeDebugPrivilege	5412	alg.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_c5b9d9eef19ff94518f3ed2540fb4e97_amadey_elex_hellokitty_luca-stealer_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5412

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5456

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5272

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:776

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5460

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5604

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b50f28dd5671e572c17ad311aa18de20c2e15d38a04c865731af3058432af75b
MD5 118880b3c3771d3eb2010f1403ca31ee
SHA1 6c651e0785e9bcb25134de9b8b09e122fd214f08
SHA512 71fed7133e1bcee767a8e9b404d9ac884607e66a6531aca465a41e3bc63425e6a2ed721d6efddaf0838fd2f75e9f0882bad27bf3b77d83237927c01e83b25e7c
SSDEEP 49152:ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxnS7UP9Fq4n:w3q6gjB97Ai4n
TLSH
T132D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1402dfc27ee57e0a74ec457d5a3fcbc5f460c01039633661d8c51cdb115c845b
MD5 1aab90b6bfad56af3ffc9dba1036ba23
SHA1 85be5e7d66f99da76126dc53157716e33db494af
SHA512 a65c1d7f86a018c237e75fa1f8fb543054e5a2b707f0749e1d0c3eeed41320ca0aa7e874b03e1906a93c82495a6b5b484f34bace95dfafb2c1f1ff688e84a055
SSDEEP 12288:41XLs5nWkxy2lRq2czA8UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:+XYpDtczA8vzUP9FOaJw4nQsXfU
TLSH
T1E305012867D049F9EC6B817CCCA18106EA73BC824765EBDB03A4952A5F233D45E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 824de52ea1509cf7811fd9158387a70f1535e249f5ad2350b6182b618cbd93ae
MD5 e03528e0eaaac6c938f2a739c6fd2dd5
SHA1 56a511ad1f6108a8d5df6eea2e5c45f2f9462f48
SHA512 0c5a0ec51db391a8e86c579e9ba86c231153147f7364f424d2915b84600c03b55838a894f3f6ea138614f440ec1ff509f496e6293aa0628e53418d80eb89667e
SSDEEP 24576:f00eQKy0+OxOrMqvzUP9FOaJw4nQsXfU:fXKy0doD7UP9Fq4n
TLSH
T1B345AE25F6748335D073C0B9C5D2A68EED7130825B318ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 82ab0bd5b6fa2b2befff3f7cb87ff3c9b748a098a3a6728ae453f0dbeacd2016
MD5 22d1143a1b73c05a852aa9d7088770ff
SHA1 d1249e8a992f0e24454c7df2ab8eab9a66f7b7d4
SHA512 7ae2382455ec35167d082f33dfff8a69ea4c260db64342534105adc22f37faf77021808a7a66efd05e424c23703b8c37742029e28a78d961421c6bb237e7f7ac
SSDEEP 24576:juK/ezSC6vUyD/aqgrvW/6q8wyu/vzUP9FOaJw4nQsXfU:H/ezSC6vUzPvuHjyE7UP9Fq4n
TLSH
T1B3756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 10f9ea10d4b7ded529cfc83d837999113156fbc39d751ef14302b5ad4523652a
MD5 28824371634be3e571ea07dc252beb7f
SHA1 35abdce618a3b332b28dae5b08735df357daaf26
SHA512 4dc2a0b6e01a2763ff4a3c99c902e78c1c72d5ebed72dee1be82c0ab519f74ab0e771f550bf50f0e000b16b7c23fb51e79402f7f0b1664dca2cc7a5e87c45c11
SSDEEP 24576:5abQPce8Cv/l+dovzUP9FOaJw4nQsXfU:5aLe8CXl++7UP9Fq4n
TLSH
T15E559E65F6748331D073C0BAC5D29A9AEE3234425B318ACB0246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 617b14710caab99af3c13a66b4d920d78c5ba0fb53aa7802660f2e687af46424
MD5 a94438d20060c4addde4b0ecdd6d9520
SHA1 a826b87988578be8c0136b273a1119952e4888ae
SHA512 f9540ff299f6a6567ec2c17f6fe25863f77eafd9b65bea00f010c18befe6a04c6fd1f6f663c201b6d1e2a37a6cb5a5b9e5e286dfa5e108af08751910a16c22dc
SSDEEP 12288:AzCUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:AzCvzUP9FOaJw4nQsXfU
TLSH
T165D423144F01C6A6F6AB48F52AC4414F08E9EFC65A3FADF9021A750EED22530E1E9F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 de512836b438f69992c8d73ec06305b0f22b64110383bf18bc93749cb7477459
MD5 9976f0c550b8125a24f137735462e68f
SHA1 b670ac05a8d67b044a765acacb44fd1a45dfb5a4
SHA512 d0f40709efc01026df663f0a778cf98ffd7cee70beed1805bc931abab3e7e9a26db0a32d2a6460bc7c68423fbad052a204b9490761a8e0f9f4884935a7f2b06b
SSDEEP 12288:xeBNUbTVO86UdWUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:xJIUdWvzUP9FOaJw4nQsXfU
TLSH
T1AF15C03BEE28ECD2C27E8CB95B91824097B278714F22A3CBD175820EDE135E15D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 9f7a8960e64b50d214f8dd5ab3ef8ba1497f8349e57f8efd135dec5fafa40f73
MD5 ee9f71b14272e3bfffdce7bf0528b595
SHA1 8d3b598634ac2442b6f92326cca42b471c5c1a8c
SHA512 e2c261c9485a25c11d2d361fcf9bce4df7c1123a043d3dcb99fc0e70beab39653d7f3668c4f64292d6365ecaa06f180a4af21a20946766ad8c36db48cdc309c5
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJn9DN5J9NRV3THe:nQvGAdlCEL8c/nRNZ5C87Ai4n
TLSH
T1C8367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 e72ec55964482f0a7e6fe14892a2cd43c91e96cc2bb261988bae745dcc38b126
MD5 5570c0aa111ad8d0145c23e7f2d4c6d5
SHA1 557dd2f564e313930fce6f74992bbabd671d7001
SHA512 3e33591c7b25e7f636d5745170a8e20248669d37d4fa06ca38e461a1dce55c381fe5becb617f845bfc25fa1ae049a353da62578e494998cbcfc4eb03b8dee744
SSDEEP 12288:NGwSfxL/2Dc3bDLLmt0LDQewsAjxUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKD:0mewsAjxvzUP9FOaJw4nQsXfU
TLSH
T10515E030FF74D436D2BF0CB61B25C706147DBA604B661AC3E3A89A9E59202D26376F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 30ac9d264e198482fac67fe3d60651c2525df392bd8168120e588fa8d0a39619
MD5 5b37335bd72c76cb94c3d4bf81bb115a
SHA1 a1a0a48649b9b5c5f2c1f631eb6aa07cfc3836c7
SHA512 507e0c32421c915eb2199f27cb0301140a814baee21e048ad6965ad12b681cbbf65216662e51460a465f74ef7f344767ca95b36f89e6095018c2646845e059de
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrhdPlbuJHnZ:BUEtQevvqc2W1cpV2XrL2nZ
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 226c6d831fa78989af8913bdd6be3301a7ec9d8ea7b9a8bdad8cfa3c5ba7fd8b
MD5 9f2ee70e1d6e37eba992fd33314542dc
SHA1 ed95f73128dee0df7d912d9f6d363e12ed521258
SHA512 32b48a48e75bbd0a26cb304fafa58c14f9a5312c1ae4180741da6d7149a57aa0524bf192b6d4660b6dd89faf0a36a7bbc2e89f30d2719311881d1ef9ae543628
SSDEEP 49152:jHbRquA/m2yL5zMfFiV+XenmE3/zQ7UP9Fq4n:Poq1Vjnm37Ai4n
TLSH
T14DD58E0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc90f39ba6bb50fc3d04d17038ac7bf6019dd84cd9a8360419b5a18e1a9b0392
MD5 a25f216f7febe5ac70070feb2b3b3a3a
SHA1 ccc4c1a82b8ef323dbe2943b6ff290c100710fff
SHA512 4812d7a6a933b6660800dc89267bb8f709a94d47c54f2ab82821b1276fd9ff22df15b90a4a69458150c411715292195b7fd4074fc9d6e68459c57e4807c05901
SSDEEP 24576:RAhGLvCFoiwtA5l7S53svzUP9FOaJw4nQsXfU:RAMmFoiq5c7UP9Fq4n
TLSH
T16D459E80EBF945D4F5B3AAB899B68171EAB6BCA65E31C20F1150D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 dfd712c9274175b59fbbc28575f8dcd6f30d074b6cb217bf2ad60fea542bfbcb
MD5 9cac448f2a8685560a166271cb4c1280
SHA1 bb5a3472605a5322ef445f4246fa1c8cf52b066e
SHA512 73a7abc7016b9abbbe50719d1bc2dd8613cc354346f8e6338af6d7a413ebf5c5ca875c557479d0434cca4bc406a3c80a6f434769e3dddd790ac98bc4de711714
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CCUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:uwuuOWlvzUP9FOaJw4nQsXfU
TLSH
T16105F14577A44CF9E9A785798587C136E7F2BC422A36DB1F0760C61B6F23321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 178cdfa13e07b90085e8699d59671530e601a7a4e9d75e2c7fd87d8f4f98a670
MD5 cbe787ac9e909b5e1d1ec35ba2392f9c
SHA1 c4391af618d987eddd2f098ea06be0b6207aebcf
SHA512 6179898dc568a3b03f7f7214db38b8bc227707be6e7b06c83f35c9300ec97115e79aa8ec52847598b0482fa950b493cad274baeaaa8f08baa43ab34f740b40dc
SSDEEP 12288:UJH1I1YUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:KHuqvzUP9FOaJw4nQsXfU
TLSH
T1A5E41258279081F5E1A785BC9DE0464AC7F2B893273B87CF0225525E6F23AE15D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca3520f1b06723911af7d288d53bd50cb791e002c8a9241e57b77b3943f05a56
MD5 c3f3b404a210ed72604eecb7c8efb2e7
SHA1 eb0c769d0c61593013bd87fea683450906dd84f1
SHA512 a822df66bc175e668d886ddd979caec431e0d2a3e0ea0f75e027eff10b69f83bf9066db8b954339f9fabb25e9f4d940eada6d4805412fbade8af6a97e351fb3d
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Up:FQRQyi36YOcP8Lvw2gAf+PN347Ai4n
TLSH
T1C5667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 da935910570b5f10e81a1c10b4d0ec9aeb31c4456682223036cee8439d0dd666
MD5 ee0a3fc2cd5c6fad7037e86d4a81703e
SHA1 5ccdf28f29099947f5ba748ad10cce28428b58e2
SHA512 ec678610c2bf659b5f321003597e185d40abf62f1294a65dd677d7a1b88b5fd69e708864680b12f1bb5b4812a7b10d5a90dee0031d35d91238075ac83f72f42c
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UW:FQRQyi36YOcP8Lvw2gAf+PN3Z7Ai4n
TLSH
T1D8667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5919c99c80bf50bdcf57e9893261120d3030ac19f1a9bb4d2a0be602210f8c46
MD5 0d41b3b3f959df29d1c57f6b6267b59a
SHA1 c930d5ea8d96ba5bd2744c6a65b24e7269f9b0be
SHA512 0794ed68af8b922fffffdbd200f2421ab5d0ab1a25b6ebda825e312929f4d72e4bd11a097d7626f5698d860b3faf0b03bb004c6175a4e6ba9340926e54bdfd1a
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0yvzUP9FOaJw4nQZ:n68Qg55nhMeWu7PNU3/n7UP9Fq4n
TLSH
T104B55A33B2F200A9C44DE1769F4A872196D17C758FE1E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9cafc1090a6adea722b44a2b067297af313c26a5955635da02e3cb8e0ba0dc66
MD5 2aacca20e73cf08e20c8ea8af5cac067
SHA1 579ef1da5bb5e8fa4aea1aebf0efe9bd222f6b26
SHA512 d3d7064fcec097ae9af7c0134f45ca46ae05bd523a31a1cc2e406953b541ec7208526fcc44db2d50e8bfb750263189ea8989e608bac12c56103d64359abd9414
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99/:Py5112gYy5azzVv569nLKnhZf7Ai4n
TLSH
T176167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 196a563538d7dcd8148e10d025d5ed18cbc5ca1586cf835ac61d2eb5504439bc
MD5 9db374fec57efd9b97254dce10625831
SHA1 39c096651e79b619b93bc997c9f137d66348ea49
SHA512 0df8a8add0d6d911313a0b49a2b6004d25d6d8477bbf158b703b0368a0b3de766e0b4f7a3a1ad03b6fd2a115e10b2cdce106adb97aa8a69048104c3acf6fafea
SSDEEP 49152:MB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glb7UP9Fq4n:Gu6JmTxd2db7Ai4n
TLSH
T199D59E13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a92bb1ec610f7cf7a7fab102a8246cfdf008fe5666338ad2ce8bd7923a71ad72
MD5 e63265e214578cd1e420a9559b036119
SHA1 cc7f2ba12c5567957fe42c73ea933420f61daee8
SHA512 832cb2e7c8ed47b6fc7588a61a8a8ee46c82658799b09e73382227ce5e772ba1df3800e97b17fd72c747501855a414e060e94e82da35907aea470e98f1995333
SSDEEP 49152:11hpsNoJpF1A6UU44CwH7R4xR7UP9Fq4n:1mifPbRk7Ai4n
TLSH
T151B5BE13F29901E8D06EC17887569232EA62BC460B35B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 785757c946393ad29681bb0e3893de17a7c642cf46b8ac9ccc1f526041ef8a59
MD5 ac62e37962abdf4397b9cc14757458f8
SHA1 94b3ba0466f0fcea4fbe6bf8c3ba38a439bc52e7
SHA512 e417a387bec277351a505ec1ea24a0d52438040abc7bbf3daca9d4718f5a8c4f769c2681115c620bc6285b2a0a29a198d1a0b1cb4faab47c2f2e7ea77a2ec61c
SSDEEP 49152:HSuZQIY0Be2K6RVtOnks6NMHqZ7UP9Fq4n:d5dKoi61Z7Ai4n
TLSH
T1EEC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 178b8247c4f7c6209b42d4480fd897d260e590c412e344ddce53340f28074742
MD5 efee0655151d514e0e5737fc7f00298f
SHA1 5b42d8c3a68debe1db042ba468d63078e08f5fac
SHA512 5654ac00621c92f9e173529c62ce296e9b76cb79b64f7c576793315614066a964042c380461459eb819f1360303aa1a3cb68e416d4704165c658f14cf63c0f2e
SSDEEP 49152:whtSn8EApI0figTgiDn0AP5wW7UP9Fq4n:hX2iyphb7Ai4n
TLSH
T1B0A5BE13F2D901E8D05ED078C7468632E962BC160B39AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 6c9820bebabeca89a21fc8680685494c79eda18fa9288670fc03acc49ef30e38
MD5 7e2c86877460fb569157e76cc3ead7e8
SHA1 becbbea412b0d92ad50e0de4b5a16c47d4ee7f28
SHA512 b896dac8e93fcdda8825155ce3fa412a8210797325619070882690c4c32fc402ff68301a41cc88ef319dd4c20c219094a907d4a1fb50f683e327d47f0e5348a8
SSDEEP 12288:WTUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:WTvzUP9FOaJw4nQsXfU
TLSH
T1B6D423244F02C7A6F19B88F55984414E08EDFFC77A2FA9FD061A610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 1d814d88d8954ed7423ac6eac32761365331cd1202d7f6035d0bf9e4d57ebf51
MD5 398e088d4e38a99b7408ec2c309f973e
SHA1 0548697be4e7a9281323fafb2aec2472c3effc9d
SHA512 266375ee12e740b11d21d83fde971021b18a6b79f0b7c80ef2769ced69f6727bdc35e2a0b8fd5966d59a040f2e6355310d5a1c0b79e71f2032df81db88f932de
SSDEEP 12288:MHUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:MHvzUP9FOaJw4nQsXfU
TLSH
T1EAD423244F02CBA6F15B88F11A84418E04EDFFC76A2F69FD061E610EFE1257161ADF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 7376901c10cd04de6abaa11dc57f0e3bc972f84bd1ab13734f21046bce4b79ee
MD5 a2a5f666175837659e7dfb06a864cbc8
SHA1 13853869fe32a207d1350aa8ba95ebe770c31267
SHA512 a330365d01c01b823044b39101c2365ec2e217914f7d2c37d1b61a4db889e6e089b0e6fde675e2b5a7cd4e382f331c9c62b53c321d45e41c4f67c2d2d89cdc0a
SSDEEP 12288:K9UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:K9vzUP9FOaJw4nQsXfU
TLSH
T121D423244F02C796F19B88F51A84418E08E9FFC77A2F69FD061E610EFE0257161ADF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 2982303942ab773e2a675d8340babd6f93c5d62097d2ba9a9d2b3631e752cf41
MD5 8ed0b5897e764059480a7b2c0a6711b4
SHA1 254945826166897fd44ccca2e0d0b0b55a80dd71
SHA512 411baa566110fc4a09ba14a3b4ee89a8db381049377cd3bd4f052531d550e1a85ff54538e337643a74d0d922819db08e808dbb6f5e121ee15640f5505baef76b
SSDEEP 12288:klhUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:UvzUP9FOaJw4nQsXfU
TLSH
T1F2D423140B1586E2F4ABC4F58D90414A85F9FEC7AB3F9BEF0705150FAE22630A5B8F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 09b5570775e1350edc838095889cecc455055ed978c33d2c97fc7bdcd1a12cb9
MD5 96fb7a0564e5fd6728c809b10edecaec
SHA1 316c7817733b3b82f9e9cd8fa502feafd1b09a5f
SHA512 6f4be32cf11f23e1408334a3e97c98d568acbe7f6c16e8bceed48911fe3c04f5453110cd40790565afea5eb049c988930e0b911ad0258bb577473666f7ea8783
SSDEEP 12288:5jUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:5jvzUP9FOaJw4nQsXfU
TLSH
T182D423244F02C7A6F15B88F51A84418F08DDEFD76A2FA9FD061E610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 269d526ec0b941a9ec59e4775567445ec81b236d40df8008a920bf9629a5e5d2
MD5 524b93e1fb67c74ffe6e53e028c92017
SHA1 88bc90418bd46600157fef82897d4a4415614100
SHA512 b8657fce573acee976280acb46c274ea8e97ea0d9ebc0302c9461b4eeb01af4c93d736d75fee3ebc8e1608b9f33540ff151dc655e4f5b56e6cb3d99f2b205153
SSDEEP 12288:aHUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:aHvzUP9FOaJw4nQsXfU
TLSH
T1ACD423244F01CBA6F15B88F51A84418E04DDFFD76A2FA9FD061E610EFE1253161ACFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 ece6d99f1276a8968981e15a1c750866bfaeec8bd6b1ea22cb1672d2e528eaf9
MD5 5bd3544acd8adc57c472760bc715cb9b
SHA1 426ca6ecc6d09d83ecdfb9e13106aefa835d8a60
SHA512 53c9513d2692f16ed5ca5b814940778d675c8b60a1e3eb4870e582b1ce51c0183a9d30197c2016b1d2bb1d5e8e6bdb374909d2f6870f98f7551055dc244d1ddd
SSDEEP 12288:F/UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:F/vzUP9FOaJw4nQsXfU
TLSH
T1E2D423244F02C7A6F15B88F51A84414E04EDFFD76A2FA9F9061E610FFE1253161A8FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 c28ca8159edd188b10df76c441133c17643f9d2e43b370f9caace225b505e216
MD5 7d6069463569ad7ddb901559294c53b7
SHA1 ff66cdedf99c08044e6ef09bd17ab5acd6df4508
SHA512 c9ea1bf0c4f401685ac5c56014ebab7b60aa5defa0b0473a53fadbd2ebd99cd6964850bbfc4d7da376ad63678d204eaafdda0888778ec18f9f7898acf78c2aa6
SSDEEP 12288:uiZwbB7zFmcSxcPvy/UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:RZMdzFLS9/vzUP9FOaJw4nQsXfU
TLSH
T116150164B35048F8EC67817E8D558906D6F2BC5A0B74CA5F03A8362B5F333611C2DFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 c1100a6af17a07f1e7d5b05ae8bfb9a9403dc5fa54d468555fd3a6cc2ce5ee72
MD5 4c3ee5b1abd7d9cdc0e198b58ffd4b91
SHA1 4a2fd874434496afbf88327cd4f3490e7201f0a1
SHA512 cb4d9b5e080f6ca1c8c922a394db8e534b5edbec65a6dcfaf1d65e39ee8a7c31311d762039c0b397145dbb09b8aeb82c4f774f590d817ff189a6905d77940834
SSDEEP 12288:goUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:govzUP9FOaJw4nQsXfU
TLSH
T1CFD423244F01CBA6F15B88F55A84414E08EDEFD77A3FA9F9061E610EFE0253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 fed5ee404c71b4e35edc66ac6313d2c90a5378a87b0828a77ad039a7c655df8f
MD5 092dfb0f9aeee91c28954e5c9612b92e
SHA1 1bb752dbb4aa6d155c9d7796c9507ccea0d54b4b
SHA512 db2a9319de5d8024da6502ea623e66fa26151f018e93577c2f8ae078728247781e22bd52121f46d0b746b8822b88380d28adc48d83a9d6cebb2c835f08158cd7
SSDEEP 12288:2OUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:2OvzUP9FOaJw4nQsXfU
TLSH
T196D423244F01CBA6F15B88F51A84414E04DDFFD77A3FA9F9061A610EFE1253161ACFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 d3bd51bc5c2e12cb1fa4ed7851f7042816f3ae79d5ca8f3f0ecbca31a91b2694
MD5 5a9aa3488779b2f5e5036f79e3e71a36
SHA1 0b8beacbb1b8a784f03bd74581c142ab7c9c26a1
SHA512 08fb7838001a7950a4e027d71aba354fb23b41d082629cd770b3e5e1ee9c1f0f417aec3d803c38baffa792f61120bb4cef9cb91d68ac7bd0be65c3d7e62d1839
SSDEEP 12288:AXP+OLR8UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:Y+u8vzUP9FOaJw4nQsXfU
TLSH
T14AF41217676111F9E17781798C910606E7B6BC721B3A9EAF0364033B6F236609E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 5c47b975a2029b590f648ab4de89adc9323d594c6c7e59e23e81d5da181c2221
MD5 32e889d75fab9778180b41558e36edb2
SHA1 a683ea1ce43fefbf3934e6c3b40ac0b147d26501
SHA512 6ae4935ba2f4cd8c61d9ac2628207226430ca2748101b5457429a049e965811ace5d8760e7191d2fc20d19a92ec6cbddc16e9691ec0cb89b24f0f1f431cca01d
SSDEEP 12288:wMUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:wMvzUP9FOaJw4nQsXfU
TLSH
T129D423144F02C7A6F15B88F55A84418E08DDFFC77A2FAAF9061E610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 ca0fea551bef9b25199348630d5272c726fe85d7b5358e8051169da087746f9b
MD5 ae66711801715717f4a54178f555bd09
SHA1 c613ae2f78d64854ce518a3819fefbbefc08fcf7
SHA512 39902daf23e2efce5dc3d57f77c66ee6d75136549fa3743991433d55e8aa048b025527e0082d25d8bbf7aa69126c694bfb0c1556d935cf76db923fb378a67935
SSDEEP 12288:4+UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:4+vzUP9FOaJw4nQsXfU
TLSH
T1EFD423244F02C7A6F15B88F51E84418E08DDEFD77A2F69F9061E610EFE1253161ACFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 babccfbdf093500dd6743a612e3854df65799ae7a3b3c1515c14d7a6c0d0436e
MD5 efb5028788e17d19fab9f04519c4f15a
SHA1 39ebed0c4524571286445d52762687752a26cbaf
SHA512 9539fd996c9089d0ce1d1def59e62a769e32c1ca941148e3a74bb3b9248cefb4b81c17e9b2b0e05a39e9cfed92ef8bf65ffd81c7d72bf87bedc5f91880ec01b6
SSDEEP 12288:VXP+OLRvUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:V+uvvzUP9FOaJw4nQsXfU
TLSH
T1C3F41217675111F9E17781788D910A06E7B6BC721B3A9EAF0364033B6F236609E7EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 e31874251b3c108aa0a7bf77cbcabc1852688f165b2a790e01270e4f48724a6a
MD5 88614c4450dbd030af37a5b7b85b945c
SHA1 5b186ebaf20cc5a20aadf99aac983ff7fd6e809f
SHA512 edceac99c5c972048640628b64028b58a3671ffcd0427d37f29d7ac317727226113b068b10d6ab8f17b42890288a04e8e54f9cb22baa4ebff8a5fbc17d895407
SSDEEP 12288:RCd95amoaLSk3z0zn4PDvhpUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:sTyaLt3z0zOpvzUP9FOaJw4nQsXfU
TLSH
T17615F1A4B35048F8EC67817E8D558906D6F2BC5A0B74CA5F03A8362B5F333615C2DF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 4f87b7ddb2f4d499616bdb779de19a53d3739155109e3e8327ceb5961e4f0865
MD5 b73e5286ff711a36ab7172002390e93f
SHA1 96c53d9d6bf9fcb1b6d08f14d4195f4448c3d156
SHA512 ff3d133882f29967f5f631afad24aa1a1b4447029c18a73a35d29553ae37523a8f72f1894f8c2c424d0bf70874b63e39d80fa04a1f8c6b4b50aac42c0dd303e6
SSDEEP 12288:Zi4e7jadxfgwCH/y7mLbbdIvmUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxd:Z3Pd3CH/y7mZ/vzUP9FOaJw4nQsXfU
TLSH
T1F735CF90F7E405E8F0B78A758D754502DAB67C9A1B31DE8F03A8651A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 7e2d54396b5aced895b8bebecc73f6d5b57c20755de1b30f7b0a76cd97679fb2
MD5 7e2b1d77ed670210948cbf25e6c47cba
SHA1 4d0b7d8461162b6dafc40e0b7bdef56a610230cc
SHA512 3b5648b1ac83ab21531d1e8ce6424fe57b44fd57718f93e1dbd096bec52f5807b1dbf8fad2213d6bbf2be3edf2ede0f03a8d76e2c07042d7932eaf018489a383
SSDEEP 12288:4PUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:4PvzUP9FOaJw4nQsXfU
TLSH
T173D423244F02CBA6F15B88F55A84414E08E9FFD76A2F99F9071E610EFE0253061ADF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 754f4abd7dfab3326f3eaada35a460035fe80d788211ef135d8577ec35768e91
MD5 d6d6deddd8e2bd3a596e23af2813a765
SHA1 e9ea8d66f68ff74b86caa551634e78db52f9b319
SHA512 69ca59acd80940160e3bc9f2f13511df510a313fef20cf6f41f6186a1c7bd4ddaaf34e91da45509625836947ec4ab3228f5cec3967867b382915a56ce83a2f4a
SSDEEP 12288:4vUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:4vvzUP9FOaJw4nQsXfU
TLSH
T1D6D423244F01CBA6F16B88F519C4414E08DDFFC76A3F9AF9071A611EFE1293161A8F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 22a49e96282e32474f37eee1c00ba45c927d91f08ba417038d87ce24b9101f3c
MD5 902b0fab4b7e65a54dda0b746cc3b574
SHA1 481e4ea60f8a5158fbd502ddd3dcdeddb5e4ca8e
SHA512 a21404de5567513b2262fc30cc202e2f6088fa806be9ffb0db547e239908d5a483bc0dc7a9b9a5dbff8f7121f6016d920ef569c2c81567caa965677f2c0b6a62
SSDEEP 12288:ZYUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:ZYvzUP9FOaJw4nQsXfU
TLSH
T13BD423244F02C796F59B88F51A84414E08E9FFC76A3FA9FD061A610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 3dee015b447a9031af4e40e9fe1200236ade3512db830f0fcb5083e7b4605351
MD5 773f06e02d1495c863aa45fd1b8c32d2
SHA1 379deac3e7953d8e303229856af3e8671faa8f64
SHA512 57fbdd98787f932edf956ab4cc1f08c1d4bf807ac005f49aae5a240145dd9209a6c969d560c77745e13d6f4a331b00af1e98a65acb386dfad85720f8935f7b1c
SSDEEP 12288:a5UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:a5vzUP9FOaJw4nQsXfU
TLSH
T13ED423244F02C796F19B88F51984414E08E9FFD76A3FAAFD061E610EFE1253161ACF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 88a5fc1877f86b17f0b949dbe4d81a33cb8b24e13ce6a645fb955703cbe12fc0
MD5 c4eef78ca92f7426c0aa2ee3ba499098
SHA1 8453ca36ad49bb4f4cc2e8097450e2fa3c7c17ec
SHA512 1c6a362c457f46eb046444b642020bf940120815bc12a73078ae3f0465b48ef1766f31d1d4893ce1137283322f66a6a19249ab599f7e3350a0d8d5d953e80c4e
SSDEEP 12288:KpUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:KpvzUP9FOaJw4nQsXfU
TLSH
T19CD423244F02C7A6F15B88F51E84418E08E9FFD76A3F99F9061E610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 122e341c991b0397d4283febe5053d591617798867698d082a7820b2f6d0ecdc
MD5 62d756cacc48cc50a735eebc5e927c73
SHA1 a31b5f9b094eaf9652a0ca17de7b2d6a3b644c23
SHA512 da64b4f3e0d72a0875441ee2ab07317ea9394a8215cd9b0cb08b2f7b7a7fa586b2e321e5f6a596d287ec31267768f461adeb31d4c697ff8d830917d6538d4436
SSDEEP 12288:TCUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:TCvzUP9FOaJw4nQsXfU
TLSH
T152D423244F02C7A6F15B88F51EC4414B08DDFFD76A2FAAF9061A610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 ba2f5ae970bc160d39f193b6fd5c9a3a8927869ed44b8e08843c7a716c683abc
MD5 316b457bd8a5874060fc9194a49072e9
SHA1 2ef2fad965c67b059055d8d94f8adff59e9691c1
SHA512 4603b3b0917382e50682aaaf44e853a06b5fda480c7d6020eefb04ed502f1a6105d304ce295f12e1e3bee79b2f9bb3165fc18c7452c630c8ee5bc03ba11e719a
SSDEEP 12288:geUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:gevzUP9FOaJw4nQsXfU
TLSH
T142D423244F02C7A6F15B88F51A84418E08E9FFD76A3F69F9061E610EFE1253161ACF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 3e10c1bcca72d0e4e093e91222ef6ec00c43dbad2172ee277cecf937cfe4996f
MD5 f4fea4bbbbcdd4d82819d21aad96b5ab
SHA1 6f06c01e992d49813f6e04ccaa1ea499baa7051a
SHA512 2e4752673319049344b2c8edda8838efa0e32592f241275ad6942f67d71f9642af3564ffdf5b67d21ff8e47c186bb80fc5a6c34da5e94df00785d314575138c6
SSDEEP 12288:zeUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:zevzUP9FOaJw4nQsXfU
TLSH
T1C9D423244F01CB96F55B88F51A84414F08EDFFC76A2F6AF9061A710EFE1253161ACFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 3e0d0ff7dfc80e8933246a30c600f7ec100f349984b5b4b68d588a23779dfc3a
MD5 e80d572ee00e6ade08f94987fd5dc018
SHA1 1df21fab69dd2e12cce953a6581e306b379cdb69
SHA512 1780f04e6a3e792d3741513f674537cfb008a96590d446f2d28bff44122f651190b2e4429e58f298126a00de8423d30c49682834562543af2d3e42ce67c2277f
SSDEEP 12288:sEsfzUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:2zvzUP9FOaJw4nQsXfU
TLSH
T1F7F4F018C34442E8D06F91B9CB854646B377BD6697E6D3CA02D0F53E1F326A0ADE9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 99fe67585161d5033fc06067ba427ebd74cedb36c3199856b3390c95ca18870c
MD5 4b1b8aa66c5d213ba82ff72391479e32
SHA1 896154c80ae6495d1533811ebb4d16b42ebe7b23
SHA512 ebd9c2a35c9397ae163c18f6c9b7a7337d1859b92bd1ee9c3a51460e31b650f6d58c718f06bed591cf5ba1e54247def99784b66686d15d28f8cf8011e659bf86
SSDEEP 12288:/XUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:/XvzUP9FOaJw4nQsXfU
TLSH
T1A7D423244B05CB56F1BF88F11984810A04ADFFD66F3FD9EB0509710EFD22960A9B8F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 704KB
SHA256 2901c0d786e60bd5ae128c1c2432c1cd78fb03201ab084626eb554df9e26ae06
MD5 ef92e2fd2ad3e22e800a10033c268d71
SHA1 61abbeb2840b3b2365126e6196eef0ca2a806531
SHA512 72ddd6edeab447cb014c632823dad22f14501dcf5bda6bfad3d2a9a8ee6d3c8f11be07abbc31849e40117bb68b87957f34f1c02e376ba81f7ac94bef6be72861
SSDEEP 12288:/rxA1U7KSUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:/rxA1UGSvzUP9FOaJw4nQsXfU
TLSH
T16BE4022D1B9C05E5F1BB947949C1810AC372BC56273AA7EF0195823E5F27EE09C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 37628d60ad51ecc0ea0c01d01dbd5f930ab64d471724ca71aff49281983d1310
MD5 b55a439a0985460a54ddbcec0d2cc871
SHA1 81aabcd49d0d1f603ad16aace62a5f5c62474eb6
SHA512 656d82e1bf8f4dd20f2b4866f3baeb13dff686ad322f4bb5c0bd2bee2d465efec0934368fcb9dd28eb3782ae2b1aa3b4f5ed7ba6e26bf059ee96bb027fa94443
SSDEEP 24576:DjsmP0yHaqrVqHra44KDzM+rnkvzUP9FOaJw4nQsXfU:DjRP0yHfVqzlA+rnk7UP9Fq4n
TLSH
T1D855BF2DF2B900F9D4AAC176454107B5AB71B82D1F219ACB0170C635AF0AEE49F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d388fe52ee8b88deabee6c89fe3e544a06bab706304a641c5e6ac74692a39694
MD5 62016ac42f99f7af3d6a7ba462326981
SHA1 42f18e4748b351c9247ffa6715920f44dd0f84d5
SHA512 24a519f0c83763a53fb7b1480ab7a9a60d28b44a26021deecefd3385f3a3b63e9de5888023f5fce98e147496ca7f02789a267d7a00371b76949d7dba5b0447e5
SSDEEP 12288:QxUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:QxvzUP9FOaJw4nQsXfU
TLSH
T102D423244B01CBA6F16B88F51A84414E04D9FFD72B3FAAF9051A710FFE02971A1B8F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 760a69ac7b6eae6850aed06bc925c34caeb21007ec46086d175b74cded6a53f1
MD5 3e19d7261ac6e30b55eb810b7ef03d9f
SHA1 b80264d38be303ee7606620b41e98dc2ab36630e
SHA512 363ebf53cc6aa69fb1260be9998d45351aa5a5ab44f9ae63198104bb86d217dcea1df4b43aadd656104088d9f00bc6f49100ffb382c009b9b2de5d9d027c4b8d
SSDEEP 12288:RWpVmzIYNvUyBpqUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:ITYNHsvzUP9FOaJw4nQsXfU
TLSH
T11F05F12E576D0DE5E57B91798AC28209F273B896171692DF01B0827E1F13EE8BC3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f136c974f5087b8a7c4dac71c7f5128012526b7a76888730fe3eb2ebc8f52ea1
MD5 c1b3f45c344e2beb072317db57763191
SHA1 4821cb936b6194c9dd19dff0852acfcfb4991556
SHA512 26fda9fd9c437311d9fb8e93b03b36d1971f46c8d66a46ccc9f641807041ac514c337d45ea0512cd7a30d9a86d5dbda469ee4730a0bf3582ac6ea4dd6e652f01
SSDEEP 24576:Wv7Xbxd9Tuycf8M/TYlSux/r2PCKvzUP9FOaJw4nQsXfU:WDLL9TuJ0M/TYn2Pj7UP9Fq4n
TLSH
T139858D5EA3EC42D8E07BDABD85A79147FAB2B855173081CF0251856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 83f34237b7d941acb702ffa0fb315a10bbc3524ebaf3da478d70db8dd9860bbe
MD5 427370a26afef8723cd474bdccc0822e
SHA1 4b8d3c57c4930d1aa91305fe1d9546abbd9cd2d0
SHA512 20dbe6d34f77b4a55e5c7e619e3c784fb1d766a51bd20e3d98d9bbab5eded3c5aa900f2b8b7dc3f84470c63a171691e2980d9b730f544114b327667d7fb692da
SSDEEP 24576:qegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wDvzUP9FOaJw4nQsXfU:qngOJOmPOHFD7UP9Fq4n
TLSH
T17155CF3FA7BC05D5E07FC17D8A928906F6B1782613265ACF0160827E5F1BEE46E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 704KB
SHA256 4f18945f5cfcdbca40fb16ca5b763f0a3db39583052c2992ead3d9577d9f79a1
MD5 1835a2e5d64fd934c4e00a4b2d4a8fc2
SHA1 a02752d68f668d3b2f3bf1f8bb0f7bcee868c6af
SHA512 65791e518f670c65f94aa9a972b74e60d6205feffe648a39c7e1954b8e7996253113e1640af3fa437e71d2ac41755dc163d7bdffef52cc9c9a353b8e29da6db5
SSDEEP 12288:VWlYJeXm5nkEUuECUUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:QlYJeXm5jUuECUvzUP9FOaJw4nQsXfU
TLSH
T1F9E4121C2B5C51E5E16F84B989914549D3B2F5A2271B67FF02A0D13E9F13AE16E3CF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 15be18a6911efd8bbbd0ff0b4f26cecc5a35da78ee2fc1ec8768650d093aaea9
MD5 afb9c43f837691a95fdd9d6ae13e1d3c
SHA1 1d3408a2e6ff024ca483b893a49ecdb8cd2dae27
SHA512 b912cc60d3d0bb26b0f01f35a28fbc1aaa060f8efb939e5d3d29de8f76901b8f6adb10f1b99576815e14f0698f14d675693a0721e1162745bedbc748d0a1e894
SSDEEP 12288:UJk6kyJUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:UatyJvzUP9FOaJw4nQsXfU
TLSH
T185F41204174086E4F5BB49B89E9241894E79FD615F2B97EF0190F23FAE327E0A874F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 d4a4ca2d317f7ab6325bef9cf143fb9c455c5bd1680cc1849ab30e06f8696016
MD5 aea1f3aaf12f980eabde1761addfecfa
SHA1 ad6289878f4521fb6c275b852e70a00b49143875
SHA512 db910bc854ae45df61d642b5b5eecf4cbb6dc5bc730ad2733d7ba3f521a572016377f71fa2c109db8870d232b1a0e07de54fbbd2d27c8932517fcc83cd0cd7cb
SSDEEP 12288:f26UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:+6vzUP9FOaJw4nQsXfU
TLSH
T1EBD423280B01C6A6F56B88F51984414A04E9FFA76B3F79FF0159F13EEF12521A1B8F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 87efd2b3ca2c4285fab9448154461f47fd8313b45e27c54d81a4f6132f54433f
MD5 5c123999eae754a543c5abb795c252af
SHA1 d5733805dead641dc32d5eb9dc84e0b91bbc7926
SHA512 44b022f43d7a904a8a71de8819cc08e052768cc44b2ad3b99fa9510765ab7c7f2c069faf13f600c6ee6ed65260b12396ee46592920a9b9e8bdcc2034fecaa87c
SSDEEP 24576:pSAwJPE1IDAo+4Kt+l4413vUQTvzUP9FOaJw4nQsXfU:pqPCIo4Kol4dQT7UP9Fq4n
TLSH
T1C755B029A7F946E5E17ACBB4D663C601FB727823133163CF4290813E1E169E89E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 984KB
SHA256 a19c824dc6fed70eb9a772923af99d6780934a28c519adbb544652a059b8451b
MD5 4b30d262ba7913796425799ac94ff4a8
SHA1 f824e5bdb64ffa72601d4191611219bb671fb962
SHA512 db1d1f1f4b3273664567b5c2bfd1dd001cadbbf957f71544193303fcec66112db6aeb0518f26d7e1d3f380f887cd6e0027e4bad38647c325c9b7c702954352c6
SSDEEP 12288:LSGyLCFBoPLCRy66NQ4tJUwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:9yLXPLcd94tJvzUP9FOaJw4nQsXfU
TLSH
T18E25E03DD76D08E5E47AC17CD6A38506F67238AE033666CB05A4917A2F27EF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 cd7bd54aa294387aa0710dd342b03fe789d95186ddea509c533f7aa95a2c1b30
MD5 beb279d6ec4015910340882327abdd2c
SHA1 05c60877d653df905579ae3cf5b410f9858aeb8b
SHA512 b052d4e69288f7ac813606fb6d19f008e4e4af978699689a3bffdb286299d858da087ba4f4dfe67592a044b52e289d04fca69e0288b9846f1b3eceab0a5e1163
SSDEEP 12288:x9ldxj3IkxjbBz3UwLvawgP9b9nmz1ZjsJdgBDkyykiFeAQsCKUMxfUU:xpx8qjp3vzUP9FOaJw4nQsXfU
TLSH
T128F4121D4B9045E8F07B85B49961811A40B6FDB3173AAAFF21C8E57B8F32A90D53EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/776-239-0x00007FF63E960000-0x00007FF63EAA7000-memory.dmp

Download

memory/776-164-0x00007FF63E960000-0x00007FF63EAA7000-memory.dmp

Download

memory/776-165-0x000001E00B700000-0x000001E00B766000-memory.dmp

Download

memory/776-166-0x000001E00B700000-0x000001E00B766000-memory.dmp

Download

memory/3084-256-0x000001EED5ED0000-0x000001EED5F6E000-memory.dmp

Download

memory/3268-123-0x000002AE14200000-0x000002AE142D7000-memory.dmp

Download

memory/3268-125-0x000002AE14400000-0x000002AE14466000-memory.dmp

Download

memory/3268-124-0x000002AE14400000-0x000002AE14466000-memory.dmp

Download

memory/3268-243-0x000002AE14900000-0x000002AE1499E000-memory.dmp

Download

memory/4820-25-0x00000273F2EE0000-0x00000273F2F46000-memory.dmp

Download

memory/4820-236-0x00000273F33E0000-0x00000273F348E000-memory.dmp

Download

memory/4820-184-0x00007FF6535F0000-0x00007FF6536D7000-memory.dmp

Download

memory/4820-28-0x00000273F2EE0000-0x00000273F2F46000-memory.dmp

Download

memory/4820-27-0x00007FF6535F0000-0x00007FF6536D7000-memory.dmp

Download

memory/4968-133-0x000001AA13F00000-0x000001AA13F66000-memory.dmp

Download

memory/4968-140-0x00007FF6F7360000-0x00007FF6F74C8000-memory.dmp

Download

memory/4968-138-0x000001AA13F00000-0x000001AA13F66000-memory.dmp

Download

memory/4968-132-0x000001AA13F00000-0x000001AA13F66000-memory.dmp

Download

memory/4968-131-0x00007FF6F7360000-0x00007FF6F74C8000-memory.dmp

Download

memory/5196-0-0x0000000001780000-0x00000000017E9000-memory.dmp

Download

memory/5196-215-0x0000000000210000-0x0000000000654000-memory.dmp

Download

memory/5196-112-0x0000000000210000-0x0000000000654000-memory.dmp

Download

memory/5196-214-0x0000000003CB0000-0x0000000003D71000-memory.dmp

Download

memory/5196-5-0x0000000001780000-0x00000000017E9000-memory.dmp

Download

memory/5196-7-0x0000000000210000-0x0000000000654000-memory.dmp

Download

memory/5272-156-0x000001E6672B0000-0x000001E667316000-memory.dmp

Download

memory/5272-155-0x000001E667330000-0x000001E667407000-memory.dmp

Download

memory/5272-157-0x000001E6672B0000-0x000001E667316000-memory.dmp

Download

memory/5300-116-0x00000207ED040000-0x00000207ED0A6000-memory.dmp

Download

memory/5300-117-0x00000207ED040000-0x00000207ED0A6000-memory.dmp

Download

memory/5300-115-0x00000207ECE90000-0x00000207ECF67000-memory.dmp

Download

memory/5412-17-0x00000220B32C0000-0x00000220B3326000-memory.dmp

Download

memory/5412-15-0x00000220B32C0000-0x00000220B3326000-memory.dmp

Download

memory/5412-233-0x00000220B37C0000-0x00000220B385E000-memory.dmp

Download

memory/5412-16-0x00000220B32C0000-0x00000220B3326000-memory.dmp

Download

memory/5412-14-0x00007FF77A1B0000-0x00007FF77A297000-memory.dmp

Download

memory/5412-163-0x00007FF77A1B0000-0x00007FF77A297000-memory.dmp

Download

memory/5416-111-0x00007FF70DA80000-0x00007FF70DD0B000-memory.dmp

Download

memory/5416-109-0x00000223ADD50000-0x00000223ADDB6000-memory.dmp

Download

memory/5416-108-0x00007FF70DA80000-0x00007FF70DD0B000-memory.dmp

Download

memory/5416-103-0x00000223ADD50000-0x00000223ADDB6000-memory.dmp

Download

memory/5416-104-0x00000223ADD50000-0x00000223ADDB6000-memory.dmp

Download

memory/5456-237-0x000001D6F82A0000-0x000001D6F833E000-memory.dmp

Download

memory/5460-247-0x00007FF6B8C00000-0x00007FF6B902C000-memory.dmp

Download

memory/5460-251-0x0000020D68B00000-0x0000020D68B66000-memory.dmp

Download

memory/5460-194-0x00007FF6B8C00000-0x00007FF6B902C000-memory.dmp

Download

memory/5460-195-0x0000020D68B00000-0x0000020D68B66000-memory.dmp

Download

memory/5460-252-0x0000020D69010000-0x0000020D690BE000-memory.dmp

Download

memory/5460-193-0x0000020D68B00000-0x0000020D68B66000-memory.dmp

Download

memory/5460-253-0x00007FF6B8C00000-0x00007FF6B902C000-memory.dmp

Download

memory/5604-249-0x00007FF7471E0000-0x00007FF747291000-memory.dmp

Download

memory/5604-203-0x000001BF794F0000-0x000001BF79556000-memory.dmp

Download

memory/5604-204-0x00007FF7471E0000-0x00007FF747291000-memory.dmp

Download

memory/5604-202-0x000001BF794F0000-0x000001BF79556000-memory.dmp

Download

memory/5720-143-0x00007FF7D5A90000-0x00007FF7D5BA7000-memory.dmp

Download

memory/5720-144-0x000001EC879A0000-0x000001EC87A06000-memory.dmp

Download

memory/5720-246-0x000001EC87300000-0x000001EC8730C000-memory.dmp

Download

memory/5720-245-0x000001EC87200000-0x000001EC872AE000-memory.dmp

Download

memory/5720-238-0x00007FF7D5A90000-0x00007FF7D5BA7000-memory.dmp

Download

memory/5720-146-0x000001EC879A0000-0x000001EC87A06000-memory.dmp

Download

memory/5724-244-0x00007FF7DA8B0000-0x00007FF7DA95B000-memory.dmp

Download

memory/5724-187-0x000001BFE4950000-0x000001BFE49B6000-memory.dmp

Download

memory/5724-248-0x000001BFE4E40000-0x000001BFE4EEE000-memory.dmp

Download

memory/5724-186-0x000001BFE4950000-0x000001BFE49B6000-memory.dmp

Download

memory/5724-185-0x00007FF7DA8B0000-0x00007FF7DA95B000-memory.dmp

Download

memory/5792-255-0x00007FF66B150000-0x00007FF66B414000-memory.dmp

Download

memory/5792-254-0x0000022295470000-0x000002229551E000-memory.dmp

Download

memory/5792-224-0x0000022294E80000-0x0000022294EE6000-memory.dmp

Download

memory/5792-222-0x00007FF66B150000-0x00007FF66B414000-memory.dmp

Download

memory/5792-223-0x0000022294E80000-0x0000022294EE6000-memory.dmp

Download

memory/6132-178-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/6132-172-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6132-173-0x0000000000830000-0x0000000000899000-memory.dmp

Download

memory/6132-241-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads