052025aac86dcf7255618a6d38557f696870f946c1c550d8ad45235de1d28941

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Size 1.9MB
Sample260507-lpbbnsay5t
SHA256 052025aac86dcf7255618a6d38557f696870f946c1c550d8ad45235de1d28941
MD5 1f8b540e55d6b48f7b1d1f7d04ad07b3
SHA1 510f70374c210d6b8f006e056030c94898585b4f
SHA512 9bd3af5f1056d113ef2ef325cc275efec1c8934711bf90615cf9d602a03a87c554fe25c5ae04f4153a31671b6babd64f0ca86e830dddb964df941ad3b066e7dc
SSDEEP 49152:cKjKWQc2b1FVgbjrjxPe1pbPSQm1Flo+LjwLNiXicJFFRGNzj3:cKjKWQckVgtev5mnlNL87wRGpj3
TLSH
T1FD95234172D08070F5F61A349970D4B45BBEFD389931995753992E2E6F38AC2EA38B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4884	alg.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
5432	fxssvc.exe
4188	elevation_service.exe
4964	elevation_service.exe
2492	maintenanceservice.exe
2524	msdtc.exe
5092	OSE.EXE
3036	PerceptionSimulationService.exe
1400	perfhost.exe
4064	locator.exe
5184	SensorDataService.exe
5624	snmptrap.exe
1920	spectrum.exe
1392	ssh-agent.exe
3484	TieringEngineService.exe
4192	AgentService.exe
2616	vds.exe
5192	vssvc.exe
2784	wbengine.exe
1532	WmiApSrv.exe
5232	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\347e78fefd664f35.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM606.tmp\GoogleUpdateComRegisterShell64.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM606.tmp\GoogleUpdateBroker.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_cs.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_pl.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_ja.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_84265\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_sl.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_sw.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_zh-TW.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM606.tmp\goopdateres_ca.dll	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005eba85ca05dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f48549c805dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000271053c805dedc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a86bd1c805dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a7336c805dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005690bcca05dedc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe
4188	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4540	2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	5432	fxssvc.exe
Token: SeRestorePrivilege	3484	TieringEngineService.exe
Token: SeManageVolumePrivilege	3484	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4192	AgentService.exe
Token: SeBackupPrivilege	5192	vssvc.exe
Token: SeRestorePrivilege	5192	vssvc.exe
Token: SeAuditPrivilege	5192	vssvc.exe
Token: SeBackupPrivilege	2784	wbengine.exe
Token: SeRestorePrivilege	2784	wbengine.exe
Token: SeSecurityPrivilege	2784	wbengine.exe
Token: 33	5232	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5232	SearchIndexer.exe
Token: SeDebugPrivilege	3504	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4188	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5232 wrote to memory of 2756	5232	SearchIndexer.exe	111
PID 5232 wrote to memory of 3120	5232	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_1f8b540e55d6b48f7b1d1f7d04ad07b3_amadey_elex_hellokitty_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3752

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5184

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:844

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1532

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:3120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2b812973f546721b60a6d4cf52af6c8df46f5dbcf9a1cff986cd705c23c7a40e
MD5 ce8454f61bc01c3ffc6e2370fca7919b
SHA1 93df3e372e92ea40f94a90f66575d680d9419834
SHA512 62ceab9371880c9756d689f2adee46ac7bd487522357cdc3cb23d2a760add84b75a39e3fdcc844a6d19ff7faa7af9376197ff328017b9bd65e45f0da257e8a3e
SSDEEP 49152:ab+632BuPkFKRrdE6ohdstBhuXjfS4LWxnmLNiXicJFFRGNzj3:M3q6mjBN7wRGpj3
TLSH
T1E6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 120ad08ea4aba71abe2046ec93ccabcb8666cce5b4c8d6c2581e5581106946ae
MD5 8338789dbc975b4d883fc42038e65cf7
SHA1 59c96ce1698c001673420e94ee3234b6630efcd0
SHA512 4d1ec05c59d1be9ea4646ba930cacf46f843d3375a9705a7dd70d58f25e211a1210eff6d7212653914e5afc8666b8b19a25e5ea58482bf2ddf3948138859cdf3
SSDEEP 24576:zXYfDtczA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WtcoLNiXicJFFRGNzj3
TLSH
T19975012963D408F9EDBB813CC9A28411E6737C554760E7DB03A4A92A1F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 05d2e4da6efb1c54ea83aea265e8b4ec46c36d5096ae315aa10e248dd5adb756
MD5 172e24d929e17fdaa8d693b3e20114aa
SHA1 f6af5de7272a40b5ae57e0228849e308195019a2
SHA512 9d0e084cda4972800205e45ba444ae1a9525821ff2e813643ee7a8e9596fc0ab3566fed0260fe2e66d84415ab059eb215d1ea4e12f73e5984498b83e49a8e421
SSDEEP 24576:r0Le5ji0hmxhrMu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rPji0AzvLNiXicJFFRGNzj3
TLSH
T1FA859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3628f9b39a45067994a2b4f8b27e3a0ae3172998f81b86a744ac0752b9d5f32c
MD5 e62c74f7926f482bbbc6a200bbe6c33f
SHA1 f423e419e1c8f9d0aefb05f13c9c01b91f46382d
SHA512 a366e1ddfc66b755735292d957fb290700b514b193afb6957e0d57d599a876f629af80147b8bfcc630561dcb64bf088a58ce0a5e75f673281b5e1482dde89b19
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWj6q8wyuY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:U/ezSC6vUzPv+Hjy7LNiXicJFFRGNzj3
TLSH
T11C756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6ada3a1cfa14167e4d707eb6402574e48cc5fb3634235c9448a6abd44a99d51b
MD5 24b86dcf0de9c6c3eb3904d6ecfe1a31
SHA1 83cbec5f4be2228343df588ef7f7f658661e77de
SHA512 7d7f5f14546e2d637e577959efcfc23bb251736b49c6d4cfb1140896e75c057b8be69ff364550bd2c3f24cbbbc2f6bc5e3eb49dda4781006821d21a4777a9f50
SSDEEP 24576:hVbqPb88hv/l+B9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hVO88hXl+PLNiXicJFFRGNzj3
TLSH
T134559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8348692c5e315ef9652d23b44752835f7aedfa2cf41a39894a75e1e57babf167
MD5 5a784591a276992148ec4342b773bb7b
SHA1 9f42fdf90be6925189d1a9016556bb7211e27e52
SHA512 2b637b8bfc5e5d8782fc1d16d29657d8dc77e7d9d3802c470db77ce9dcedff69a971aab1d1f9251433ad21c8ffa5867d02db4b1b61b8a8414bb78a1fa5e38de4
SSDEEP 24576:WGy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0LNiXicJFFRGNzj3
TLSH
T1715523D3468855B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E923CFEBCF39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7438c8ba3cb60b5130a80f85ba9714cbdd7a6d66a1553f3147ae03594d04616e
MD5 a9908b7f46356c878873a42d7f714c57
SHA1 8ddee41f157b5f7349ede1bc0bd4c4c48d22ac4d
SHA512 ec04cf569a22989810d42a9321ed794aee0f8e0bd0a0c15d840534debdaac4fc5bd82a2c1139fb5e50dc3f09e73490cd297c8f154876187b21d8fd4faa108a25
SSDEEP 24576:4JIUl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4JIUlLNiXicJFFRGNzj3
TLSH
T10F75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 391833a9f7ebba5c275a4c4a20655845d9a15cc0565af6b5f45edf5b7483dd62
MD5 06064eddf55b4866ec3c5390a4bc6716
SHA1 da4840ce3031d7fc5638e788c09c40ea842efcd2
SHA512 9c46161cec8567e334b211b09a057358a556fe7eb1575e565648ad9929fc88645d8bfe99b8bacb904b925a5b82c99022bec3bf9dfcba24cfb37fe931a15293f0
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THt:oQvGAdlCEL8c/WRNw5CI7wRGpj3
TLSH
T131266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7125f3f9e2c22bdd34ecd5ef3ec699493feefbfd0138c732ebddc1554c7c2bca
MD5 3a512015ab9f9eb961338621dcae2fc5
SHA1 259e794a39122a1181b761ad0ffcf3ed43f9beb4
SHA512 35783945736a55856b6472fbe5256351df4f34c4ec87ee8ef27edef518f0c67ad43fe29f11426fcc46955fe6b8ea114b86d57e86ade39ac2c73b70d20092c712
SSDEEP 24576:9fewsAjf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BljfLNiXicJFFRGNzj3
TLSH
T1B575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2eafe2486175e6cbb9fd782cab28e198af16f535c8544a2049680c4b06299f10
MD5 0706ea177d8e7f24a67165d924d04c5c
SHA1 a463dc553dd8495bf47b00a1a1e266de93c87dfe
SHA512 ad0dc00ada79e65ef48e391667f786deb49f61c78f4e6ef752ef5bc715c2b5a880c8728ad5b2901d32bf60b5deae9fdc21314dbd05e8a3c0895091e48b0d9bed
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHLF9:xUEtQevvqc2W1cpV20I32Z9
TLSH
T177474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2471e669825b2bb74689b3cd802a2cc63538627daf09fdbbbf58123474af7014
MD5 bde558ea828a65c91db23936ff4782bc
SHA1 f10125e47a97aa59ca07b3ad75826046d803656c
SHA512 8fae58ffb06bee98fa33188ed6e75cbe2b9542789ccc16872a60df443e894db18215cc1c4a43141c4d2fa574d057a42d5791cc0cdb6751a531bd68d0738e762a
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/z/LNiXicJFFRGNzj3:goq2Vjnm07wRGpj3
TLSH
T105D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 238bce5068f2772cc667987e1ade3eaa333730d01b1f801912cf5a0df43f71c8
MD5 939f2e12e20fb76dfb9b479b6177bd5e
SHA1 53a9aae8850be3c13c78832e0893af6879eced41
SHA512 e09e7100322c30e7e21bbf39a4bba66f7e042cf37617e15b19d78cc1d8fc3f14890227c26bae5f3a544ca1c0d2b948f07a94341eacdb84e2aac38fee39ad9318
SSDEEP 24576:sAhGL6IFoiwtA5l7S53U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sAM5Foiq5kLNiXicJFFRGNzj3
TLSH
T173359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ad218feb1299edbc0bdeea697cb580dd3032df8b61a726f88c51bdf1d61737b1
MD5 6bad2dafa43b765aab5320e6c246347a
SHA1 defa6f0df3a54d53db7a662d4b69045c63466d0c
SHA512 fb79594a44eb5273c2928e962ca095fda3b41b12726bbb1615d431409250ff15a0276c7d34463861949dce5c284a20ddf4f9f62b4b86948382bfc09886f925c2
SSDEEP 24576:6wuROWb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6wSOgLNiXicJFFRGNzj3
TLSH
T1DA65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 871d90993f110dc59206ecd04bff1587aba57807ddac69b00fda65d2cdb502ac
MD5 2356db278dc2dbff58a629c342cbc7a3
SHA1 53eaadff954a727205d76139e7108e85d7033501
SHA512 30baabd2b074efa153198fbe146206141f72f93ac2fd90f2417e2a5b287c6b79636969fc887bdc9af0c2e9cb2d50cd96a22e4e4c1a70627606a960c1a1c6bb2a
SSDEEP 24576:GZuW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yLNiXicJFFRGNzj3
TLSH
T19455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 623b440b379d2beda8aced96721072aaf6dd64b900557bda6f6b3c491958df76
MD5 ca7640563b72f437e3b0a549388666d8
SHA1 513274051206396ac5a0136413700924af680787
SHA512 f7693cb44d9828b9405bfcb885e066448eb80034afe23be044976086384e07e3a942d5a77216cf1d7ddf9167271c6fc089b34955cb2e6f08fa32d84dd6d3f68e
SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:MQyiKanX+PN1F9
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 312e877da7eaed8bb3f4bc72a32956948df2bb7d77ea35dcbd65587749cc5c5b
MD5 10d173d99d2e7123ca100d59f71c34e3
SHA1 93f6951b3a1ad43108313140c1ca12cdd025e942
SHA512 8110318b2270537034dc1216fc1e1e45ba0240cf24938d16fd28b6c98b4db46116947482ea21278a996a0652095a20536a800cc2d58644a0e255e1d536a1f2e7
SSDEEP 98304:6QRQyi36YOcPDLvw2gAf+PN3B7wRGpj3:xQyiKanX+PN1F9
TLSH
T10A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e94a09a4f97f89caa6e73ffbbb8ba0ac56eac2728adc8d7adacc3aa8bdba9566
MD5 a8ae6951aa2526573e6259583fa5cd4f
SHA1 c63191c830b592adad13510f23648580816f18cc
SHA512 c845ac0def28d2c758e26c72ffb92c4568797f5a7f50ea580015ff593b6cd0e8f01d79d7c0465fd5ba864a40040e56bbbbc3c1719de37d43ff3f3c4ee743e835
SSDEEP 49152:n68Qg55nhkeWu7PNU3/vLNiXicJFFRGNzj3:RthTRc/v7wRGpj3
TLSH
T174B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3207a9ea81001086a3284ae0c2473ffe4ad889857ff0d21841743d0e063c3b18
MD5 81c857b5cffdc99a5b124e0907bfc007
SHA1 a10ea39c4275907980edc351a97a799926a82a5b
SHA512 c73e97fbd18440bf413e80a1bcb092d2d3736ddeed8b5f93d2fb1fadf4922116dee8f4bcaa5ed0835305c041b01cb42b2357ca7cbb6c91f04245ef8ebf62a3b0
SSDEEP 98304:4y5112gYy5azzVvU69nLKnhZy7wRGpj3:RLIHRWhoF9
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd964e8d3eabcd6ec91c1df850f25752b8ec3c47866920e5101d7783653da4a4
MD5 526d7b6bba040348f34adc1da7024aaf
SHA1 65157543a8a7a0e1a53caf1c29d39604c896ed38
SHA512 7c1fba9e8c70f72a2f8185b111ee43e9dcda9fa0900a96f82cae1b9dfac2172a72e6907f84f74b95e842a882a702b627948055e0e25cc4779bdcf5c22c072b5c
SSDEEP 49152:aB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glJLNiXicJFFRGNzj3:Iu6JmIxd2dJ7wRGpj3
TLSH
T19DD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 63229c27f4c440ed3ed1d98cb058bcce4b80e58b89c4509c23980c79e7896eff
MD5 4e4f2439dac5d5d3f992507d4bd84f22
SHA1 fb72fc3edd93f33a8b2532fefbc7b33900c56691
SHA512 f3c3863581a2c6a1b086a1a28110882eb7c8c058610a97179ab061f466266dbd32d18e5f82c9248e39dfd29c1afce52ceac249e1a7315a50121b552aaf532399
SSDEEP 49152:d1hpsNoJpF1A67U44CwH7R4xFLNiXicJFFRGNzj3:dmifPqR07wRGpj3
TLSH
T15FB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0f1b5a362cf59f63dd296e27a1b81bc53c79da1c8e30da7d8066a29831e4f694
MD5 bc906806d032e9bd59d670bcfae529d4
SHA1 d153ac86a2844226485bdf786bf8cb5c95dfd9c6
SHA512 e7032ac34cb1845f6e95f92d6a28dbefa1d0f0041398f95aa8753de843efe2cebd41341ade1fbd954ca30008b7f3b8a719d669da6c93e0e7d8de991455d17b91
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqWLNiXicJFFRGNzj3:P5dKqi61W7wRGpj3
TLSH
T152C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b4104d1f7979863a50a614a6fea939c4abb1f062ab6e511ca3e18c747d8feb5e
MD5 adb0b1a08f68aa354ec6c6d11ff5ef53
SHA1 bfcbb16dcaa79a66ceadb40f5afcfdcaf948ab0d
SHA512 7dfa798016cd6a72f99f3073d1b6bee4e3030fd7a46164281677cf61b16c63792e0885777f120133dc2e0b15f2cc7b02ec05237709f4e838a3abbd9fbfb13e09
SSDEEP 49152:6htSn8EApI0figjgiDn0AP5w5LNiXicJFFRGNzj3:7X2iWphA7wRGpj3
TLSH
T12295BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0fc1c2fe50354f37228fcbc260066b1a1e1ed1f8b6b6e809800c0c188c1ab7a8
MD5 42e10c2797ed08e25d593e9cd6e3f997
SHA1 f97a7a3f3007bf70b6699502b99870110bc3b9f2
SHA512 ac1a4ce8eac9a22ab5bb0a98130779ebe87543842c5f4992274ed332b4de9b861062b9f760f9c2d90c99c9a8a5d10eae6fdf9d312f73e67f5892d15605358b8e
SSDEEP 12288:IoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ia/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18D5523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 060599d6605613ddb6c1a01e58ba63ee415320a9177b241fafa97e0ea1c40cbe
MD5 f010a609b69d797d8ecb0bf1a0344e81
SHA1 11c2beaf3041134af24d03fb718981fbf2628241
SHA512 2bb2215b61a3750bc87d591cd4d6c79fb28e8a3a33387ef2979063a5ef71cc61c9746837e36eb8d07270c3720475884f6c192eaaac63df53a168f4a63d33b14c
SSDEEP 12288:RniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7b36ce8fc52392c7ac6bc4ebb0a83bc5258d57d4dcd5a79b6785cf56841c930e
MD5 e9a653faa02433ccbf8610bbe3665c67
SHA1 21283589aeb561280f8d6e9242904006bb9b0b7e
SHA512 0c47703856dc6b408de51e0b0f1e3fcdbc6d873b830d81308945b6f4065f4f0bd8f936c466a931313f3cc40884d9fb1cce7a9c011b15b76edf5bb7e93741d617
SSDEEP 12288:8hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 399abae82fb08cd57a306ea82def44b6ab2a08b48eb5027c34a2e87be80b9fd1
MD5 5baec962475e8107458b3e7cba0fffc2
SHA1 1865bcf8b57fdbe00d681664dbeed58b3993b339
SHA512 e1853072b7e61bce1fa55705f720a303bdf3815da394ec6ac55060f860188867ab7c613e8882b949bd832512ffaaa949dcfa3c1915b88e68d4ed4ae39e3a281d
SSDEEP 12288:jVSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:u/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D552393168901F1E9BD803DCA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fe8a2dde47c04760de27d5b5b0ba17a928661a7327d000e1fcfaec32dd1b059c
MD5 78adc54d98451056156aa1d81f687042
SHA1 6f7293cfa282eed91a0f1f80043e04fba93b20e9
SHA512 25926aac15fd979877733a7f5d8c36d3ac22358761a90153705afc25744d55b92d51d04b693661316fb93d67c0585495c5ddf0bf8c782de1e9afb089136c70f3
SSDEEP 12288:CKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c3fda2c5ffd27926564ed4561d6cdb22535a6f97e624bb28a2d1ca10da11ec49
MD5 cae86f08ed1464281db0e9b918d0b4dc
SHA1 e4f4b3c9839c41624567ede24266ce9cc8b247e1
SHA512 0f5b994fd3845952578034b672fe80ac193e5869a511d82a18b44ecd43b719cdc2b96b64b60a76175bd82bf5100552eeb720e9ece39137f1da2ea76190c82da8
SSDEEP 12288:PziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:PH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F95523D3548955B1FABC0039C6764428F5882E2DDB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b5ded73808d77a5dc15a1d033ffdd97ae9ea6387a4ebcaae7b64a7243114cbca
MD5 540e4f0d19bf7236a923fde98a239efd
SHA1 39695e2dbfde996a5fa2c30fe51ce2e481cb0813
SHA512 f491ab4dacae05e7fc0d66eb12ac6c6236c2939f086f54bfa841961223b937ee5594ff8140c45ceed8d8a15931360bf8abd377a8cacabc27723442dc1bb6fbc9
SSDEEP 12288:QfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523D3548955B1FABC0039C6754428F5882E2DDB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 1bfaa6319ae1bfce7a3c0251b24f5f9b4f4742e689f4fcf1b1fa80da09ad01be
MD5 b14e6fcfa93759696cc8a4d20954b3f6
SHA1 bcccdbf6ff0612a767eb5653b6a8fb2d0601a1ed
SHA512 230868651b169c19d345ed5c16bcaefd054e1584d1e27d8deb007caf53f2beb39b38756ba84739695709eddb8af53d85d90ed6c1c3241d72a713567529704ae8
SSDEEP 24576:GZM3zFVSOz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GZM3zf3LNiXicJFFRGNzj3
TLSH
T108750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7f8650c6da82aca51920bc20599798a9c56b08801b3a895e0c011bcc3e35f918
MD5 020a73a9c3b17eff7e0ca16c7c42ccf7
SHA1 1fd7f448f7cf08ca5cf077b74252cfdcf4222fc8
SHA512 d6df2886cf0abd5ed72b9af68e730168ce3c4115a383a57a2738f796e9652ce4bf0e74ec34f93e806a856706e73c591ad23eab5721d433e501fbdcc6b30ad57d
SSDEEP 12288:28iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FABC003DC6764428F5881E2DEB5659E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0628f9f16be36dbdb46e3f5a0f66662b975c36c733034f32c9000642dea17406
MD5 b1f778fceb050689fc37f8230e8e969c
SHA1 af85e365ab40ed51fa0ebdb49049ba3644782c3b
SHA512 35a602bc3e4d3dbdd6e34ed4281a8206449c6434f1d7757a9f461b4ddae0f36320040d587cd33c311f54223707829a342b7b61ab039e519290005f3852df8295
SSDEEP 12288:0wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ebdc14fb77b7acd2ab8ee76b37a8275b723136c74cdca9dea18fa15765dda468
MD5 d0dfde742adc2a910e62a232ae629508
SHA1 3bf6d09548454cae7d6fb4ee43c451858b2fef13
SHA512 3d297d8690035ae67567818c53bfec912ef3d0e649b0c867f3821b9f8eb653a1e09ea52946624d0e63882850b20652bec04b882f5ee141a5dbbda00bff5464e5
SSDEEP 24576:lzyP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lALNiXicJFFRGNzj3
TLSH
T12D650147729530F9E17A8139C9620915F3717C3647208AEF53642A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d74d341adce7902eca1335a19b9bdfc95f76d42d35e80f8d4a79efc95f5e5323
MD5 fc02e9dc32bae34bc8b2368c3cf5a7b2
SHA1 f793a0d09650c05f5ebfd687cb27c73b565ba4ed
SHA512 a77e8debf99bc4514066b669ce1a3c40c171449e0280afafed36010d8d6875772180b1b731603ad51ecc27499cca6dc794b01ea94164245cd4282eafef64a24c
SSDEEP 12288:I8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:IG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10E5523D3548955B1FAFC003DC6764428F5881E2DDB5659E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cf78dffd5437fe25f0927fc0ffa865b6c84132d4cfc4743f5c7de1c7988cd1b6
MD5 9142ddc60ab5c911323a260ce579eec1
SHA1 5608f9839080584e06ad2d0a9435a9d90ae2c168
SHA512 a160025384bbc0cf6a81dd58ebc05c2d5ec16b6dcfa56239252fb3a3070bf1e714aaf40e5b9ba36960cb15cb8063c46c69f78c12401d55f734ee1fc243a1a776
SSDEEP 12288:68iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C55523D3548955B1FAFC003DC6764428F5882E2DDB5659E3E2083D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0bfa8b873a762d2edf91f5eb7d4c2cd5400c31b5d52c548d37afc441fc16b168
MD5 617f7c1e7ddfeb5b73e4be94faeb011c
SHA1 f68cf0e87b59b1e1c486140ec32f191eff6b940d
SHA512 b501e99ac20a6e7d4516e31c19a7bbd338c0a31ec94871f421d35821dbbde41ceaec5afb62c9cf1d459cd91b218f2ae6e6f021cc7065499771cb822a296a8ccf
SSDEEP 24576:JzyP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JALNiXicJFFRGNzj3
TLSH
T106650247629530F9E17A4139C9620911F7717C3647208AEF53641A7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 59d988f56535bd670a803d05caf697be1cc277f80d09638b4a367b3e2fe89593
MD5 2fdd0cc81d93061fb1ec1619a22ee0b1
SHA1 cca3daed46e0a265b290fd12a2df2a3ac8bd4266
SHA512 467459e9f51fef31a177cc07b975faaf4bae5ebd66be268e8114c50abd5f796279b459716fb80ca97bac18df5ed52a1a9742ddfe21333eff72d336eb4bee34d2
SSDEEP 24576:sT8aLl3z0zDd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sT7LljYLNiXicJFFRGNzj3
TLSH
T1687502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 63152b07e27ad7c45bf62629e667f0da1db3e9fbed87ac0e9a318ee33a23b9e8
MD5 3c3d5e94a91d3ed7a1c4afd5b7db1610
SHA1 3d814b58b1d9e973f1a8a6500440fef2d1725b20
SHA512 bcc812b00a6c3c29edca2307fca7432faa23d86883ec352903b36b34677e535fdfa6648ee6cacb6700705a3c53eec4ead327ba5cdaa0d0405f256fa4aedf54ca
SSDEEP 24576:bcP4mcvIjkGOxhKP2l71nNKbrh/8KB+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QP4m4IpOO67W8KILNiXicJFFRGNzj3
TLSH
T14D65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 235613ddbc3396851de85db1e61344022dadc70f631bb5335c12d256f1e38260
MD5 be3f1b96029b1ce9aedf324bca06f159
SHA1 cba9fd20be76c78e1ab60556367a74347a5ada14
SHA512 b4a2896bb1547744d4b31b8a54b4789be4af289c11ab5d21d4f1e18d01a11b57934f1d10f5a63105e56c5625c1a0e0453a95d48a60f3a35cc58ed720a4806214
SSDEEP 12288:cpsfsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9W/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB53C0F93E1F7AAD59EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 017a80ace3e72ea5b50d0654261a086a0c9e55714837a983193be88c5e729999
MD5 e91487c22c3c7148c966e2568cbec2c9
SHA1 e39eb4a0a8641ed642b967bec884b2be5cac058d
SHA512 20337ab197689bc5e34bb72a36e9b6cb78d10ba11f3148af95e445dd9194543bc97cce19da9a530e273ce45c5755a121d4676da5c753c3d8bf59300727ea9f10
SSDEEP 12288:sMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B8552393568C5562F6FD1039863A8438B5497E3C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 92910828c8062abb934515236290043672282c9aea7b0348f5e927f078a681b3
MD5 134d3e0a9200f1f2e0a406d0fbe0896f
SHA1 cdb3c5285efa413f063545171e4f8c3abc9495b2
SHA512 5ff247f7464d475878257b1bd79fb3400a1772230fc8a85dbb33502fba4175dd33ef43227780694802d733e92f010e37943299ff464f09a15340d6efba583e15
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQMLNiXicJFFRGNzj3:Za0hNYG4JwX7wRGpj3
TLSH
T15385AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 0f1d1abb2a036a63d7e7811eb5de2e4c9f2b4d926444917e008f807472a55cd1
MD5 a4521f1a4c252da6191157c35915cc5d
SHA1 8d107064e98279254920f1a18e7ee7b4a59443c0
SHA512 468bc679872ad8ef357ff8bc95297ac7b1c7dcd1568a45e6c5ff4343f47a251db8d6d7488632f285f57512f6a9d4db9807982cb0e8be2e5ed7444e310a6e52fa
SSDEEP 24576:fhbHjPj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fhbHjrLNiXicJFFRGNzj3
TLSH
T17B5512BE169C20E5F5B5903D8666840AD370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c86a19248417accc4f75349387d1fa514b33c0fe341184fc2b45708c1d8b2e5f
MD5 60b3c96fb99719c5315ccadce4691a0b
SHA1 38dec008dbab0d1c3236717b5713180c1df1d9d6
SHA512 69b6b3f92d06e766da287c64c1b7eccc4a818968aa41a33c1d544537217fd0a9da273c35167f3fc312236c7d628d94ca3f72ea06f0b8a377572e3b61a3bc0ba8
SSDEEP 24576:43YgnJcRTk4yti+R5dBR/b/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4IgnaTk46pBR/bLNiXicJFFRGNzj3
TLSH
T1D845B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 1aa38094b361722b6f9ba7735c7f69a3eebcebed20915194fe5c7175d8dfff57
MD5 7568824f9d704797efb2c23ada2e8a11
SHA1 524529408885a2f01e5a2c1dc57d3305f5cfcdf4
SHA512 f98a8ce6f6e4a4a95333014385b8167ce35564bac23918c34f9204b68a09f1593b0289461928759072987763f2121cd62efb3ffd8a18784f6904b13bce1a3cf9
SSDEEP 12288:LAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DD5523D2518959B1EAFD003D867A4428B5442F2C9B2619E3E1543E1EA27CFEFCF38563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 a4d468d2d58836dbcee33d7d35b7a57511961bb9ccc948da591ed49e900b4c60
MD5 ee6b4cf3ad3fc9ad6d769563c880c415
SHA1 6e7aea250aee45a112640c18e6083bd332ca78a6
SHA512 6b1b5c5703928b852217e98bf4feabeeac3babefe75587853cba24a5ff88018fbfc32fd521cb97a7d025b52d20dcafcb276c877e70dac48ec6bb767bd17265bc
SSDEEP 24576:SAL3UT5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SAL3UlLNiXicJFFRGNzj3
TLSH
T1DF750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 453079286f2a9e66db1e4fd6e62aa3b77c42197a3de98bc28c3fdbb613c19108
MD5 0ef45211586b934c61eeb60de25638c1
SHA1 27d48873e4cbf17a9f829646bb67c68f5e10e437
SHA512 66c20b0b165eacfdba8d13b9bc8a540c451f294d0f7fa4767a0f2f1412436a088f8d19e219d8e5eaf02047ee2acc3d5de5a0d68070e780859dd18db832856ab3
SSDEEP 24576:UOF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UOFLNiXicJFFRGNzj3
TLSH
T14255125A32DC10F4E579903D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d293cda769672458ad340698060836d6943836d49a1f5faf5522f3c9d8a6ff4
MD5 f094c81e6a494f7101de137ed86bd2dc
SHA1 a39e4a367009f16f4f4377979da6a60697f4c2d0
SHA512 aec9e1d76bd9e145024f0f222a1660445106f6ca53946625b2e670af6a5c0db5db99b91367fff87e19ca563f1b1cc62a760b9e5fca8f5f22c4ef0539636fa941
SSDEEP 24576:L7NM9YqZqmWMUkPjZM48Mv6bEhsG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L7cBWMpPjN8DbEhDLNiXicJFFRGNzj3
TLSH
T19A65AE2E6BEC81E5D477D13DC9A28205F6F1B8611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9d67378d9f495ef0045096e8f6b767a5deee59b6a7f95501ab675e47943bbc0d
MD5 e887f6009733f80c29b08b7439b46235
SHA1 c9b2e81944f73184f7a7dfd0dec87bfe924a00ba
SHA512 57bfb0ce67067a9b3ce76f7a002ce424ca01b7928315903ebb80966951d5c87bd0e123744081b46abeac38f84e29bb2a6b47ad4e6d9442e0578c36471b4feea3
SSDEEP 49152:GF2YuHNETovAvNYf8kmmLNiXicJFFRGNzj3:H6BCf8kF7wRGpj3
TLSH
T1AC858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 46bdedd8cdd76e59aa6fad520f5428f03ffdf76c324988f77330e0fbf7d5914b
MD5 c1dd2bdde912538a353f1a2270b318ee
SHA1 3f7e99d178987bfb48b508f4262488b29f4c90ec
SHA512 8149c883aafa387d6f346da13b68519f7a0968683f7617627f914fea0c153b37a02666dcae731e35da90fb08bf4b8f12c195a54ee2207e6ed48a282b7ebfbce8
SSDEEP 24576:HAFs06+Omlf8NXEbToh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gFs060loXusLNiXicJFFRGNzj3
TLSH
T1BE65BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 eeb51ad37ec9cd9a6f4aae639270a60a7b168f8dc46af20277fcc07ac93a0ed8
MD5 cba8def3e2d161b0c3829f5e0c78dc75
SHA1 3e36607f94869323a51e3fe12084890051387fcc
SHA512 98a27bf40556539eea6eff1de786b40e111f7f10e4d2b73f5a0405cd56e717d0b123577f6571a0b7f6f3400de68b14ccb3af4a406a092b2931dcf92e186bbfc6
SSDEEP 24576:rJnJ5D3WXs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rJnJ5DGXsLNiXicJFFRGNzj3
TLSH
T1DB75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6063236d86325472438ddb1dabcb4235b485775f7571f9a3b481087c60384369
MD5 899054e5305667ef3783d32aaa87de77
SHA1 f370beb74e953ce20e0901f3d5d905165b018fc9
SHA512 938c08a16b68cdde151fefc0d63654da2fd77aafaeb457f0f424a7e77505522eee875726721d5d1b98c1b5c3b13eddeaa4f65a7bfda8d3c40affb75e620e71f7
SSDEEP 49152:zg06DIKdwc+eQnSt65aVaLNiXicJFFRGNzj3:Mw7wRGpj3
TLSH
T13D956C16B7EA5294E8B3CAB1CA6295159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e179ab0f285919e9d9c22ec0acc4d2b45fc31c229f3bc0604d7894a24572b9fd
MD5 7a44150b0915708147d4eb12c9f643bc
SHA1 6fb2dd33ba657818acfc54a3234e691a5be76e37
SHA512 8957828028014a3e84616755b27f5da0b5f0073329bb8fb8f059273aa89656c0b9ef46bb67a758a6853b82c6c40cd4b475c268a10bab4415e8285a637feac1fc
SSDEEP 24576:kn4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kn4LNiXicJFFRGNzj3
TLSH
T1195512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ace0a2b4c014c93553777397d09d410118f82da0cbf3fff9b0038e739425c829
MD5 1103614c26c0376f21296f50c7604368
SHA1 4acaf22183d1fcecc953bc06b08b1bafb759a1f4
SHA512 9adcc6b3daa04251eb57aa94b78c397c2dce4fedcd6b86b9223fd1cd8063eaedde33f05dc205d1efeb85de3a71ac417649b18f0fcc6b04025d38017490d4bfe7
SSDEEP 24576:fIyT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fI8LNiXicJFFRGNzj3
TLSH
T125651245538860E5EAB9013CCA774064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 12ee4e101b3cfefe24e2d7dfb6c7de2a7d44195415a00c3293f10e50c21ea813
MD5 458f0c7fbf2fab32927113c4d70df35a
SHA1 cd5ea06766d656ed64d1672810fdf8da0b8b0afb
SHA512 0d2fb4737034ce6e6da69b8033e12ac76230ee4925878f02cfaaf8be3cb24804b43c9b55d2a4e455ccd6e214626889a01e78cff8660c6d77fdf34d86e5ac2b0d
SSDEEP 12288:8ypiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:p1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A855239A118964B1FABD003D86364824F1543E3C9B2628F7A1947D3ED379FDB9F38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 116efa9d1220325fdf808c5a70861b8cb854bc60ae17822a201464400f8aabdd
MD5 f46ba12d24c03b4c9f76a046dafc5ba3
SHA1 3e95ccd045c8f5dc03f97694f7a6c0b2aee75d4d
SHA512 c87ead3d0403aa304e9c1ab0bfe967b8772543f9e04ba41932bd101b176e4164637db0725c677d2a739c50a91f649714a30e10df0ab447008349084aae85432f
SSDEEP 24576:bQ9MxZKdcz9dw3O/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVKZOLNiXicJFFRGNzj3
TLSH
T11F558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 72fed13c0bcebad0de239ec661c31a91f611503e307a06f3777370bf6ba40f13
MD5 c89a88b7df5d2cb783fb23f047a96b6d
SHA1 0b0bf8b1249af2a9f43680e00d2e5a3afb7513c2
SHA512 e98bb4a2308f326d16cb75f2d5f3ad64579adeb6c82f7dae8981fef0dc79a5aeca5c15ca4f54b1992cfc49d69d46c28cfcf69e81314b7801083269f08bcdae96
SSDEEP 24576:yyocDApf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vocDApfLNiXicJFFRGNzj3
TLSH
T1CA65E05FB76D40A2E176813C89858204E773B4345B6257DB5281C73E8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 441097ef2833c6793f33ddfb5531fade4bec33a1c1989ab5a12b788ccc5f83c8
MD5 2c3031e2bd929e1bddff51fc72a91a58
SHA1 2ede87637b1b10eba1ae94891f9fbc7cf653bea7
SHA512 7f583d7f75254cf3825c370351a79ac041a3c9f1c57dd4508f22ed89271494741012c8d8e7fafb86d9f679b766debd44b34fe7670a169c76c1d05618252f45de
SSDEEP 49152:nWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKfLNiXicJFFRGNzj3:f0zuNI57wRGpj3
TLSH
T17BA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 444448790ad1ccbb7df56019c2d5ade0263ab1bed546c2bb6bf227271694a40b
MD5 54b0ebb413fc2458edcd1a78f75faa61
SHA1 f8fa555798c1caa035282505dc2f5e53431835d1
SHA512 3b51a648d8f130105c141d97b11a5a01f40c61da22b173d289f6f5e38c8ccecc9951fac9378315ec3780ddd0132ffd3303432214c3b5d4376e49f13c79a86c95
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYzjMqb4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3TDxR+N5YzTBjMlLNiXicJFFRGNzj3
TLSH
T1CC55B02EA7F815E5D1BE85798B23C512FA727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 9dbad7af32936b570ff43a2661ec4359feae084222b22a08501bd328d91f04e3
MD5 a4d2bdbd8d6d392d71b5f2d5d93f404c
SHA1 5b355299d586fde3f3492d215fac91e15cfabaed
SHA512 3ac62f1e7c4e7a5b38219c8627dbd498bdc16ab45bf71effc2a351d7ea4c3678d4755458751ca3525fe01b8347e77db7c31e6b983567ceb71ddc328852df5296
SSDEEP 24576:dTMdOz0FFS+UmSL0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n0K+UmSL0LNiXicJFFRGNzj3
TLSH
T1AE75E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 e1e77ba2f32eb918c637fb8231d491cde2623ddc80b27af3697d0ad2407b3b33
MD5 7b295e5b69b2fd7c4a1ffc96304e8e13
SHA1 9672001360284f377a15c23062a891374234db90
SHA512 b0754b1da6b65972fb672d4a229e015737ee4f3f6729eace8fa8bb61147ac26bc95e3baec1c6af052db05586a50b173ef8ac40df16f7d6b131c954b412cae24f
SSDEEP 12288:84KViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:65/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10755125A13D830E0F5BA5139CA364014E660BC3957255AFF31D0A97E9B36FDACE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-204-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1392-210-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/1392-212-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1392-439-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1400-170-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1400-175-0x00000000006C0000-0x0000000000726000-memory.dmp

Download

memory/1400-231-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1400-177-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1532-637-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1532-238-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/1920-197-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1920-191-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/1920-199-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1920-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2492-136-0x0000000000C70000-0x0000000000C78000-memory.dmp

Download

memory/2492-129-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2492-131-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2492-123-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2492-134-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2492-137-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2524-139-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2524-218-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2616-590-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2616-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2784-237-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3036-158-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3036-228-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3036-166-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/3036-164-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3120-469-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-478-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-454-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-453-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-452-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-451-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-450-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-449-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-448-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-447-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-445-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-444-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-459-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-464-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-463-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-474-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-473-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-472-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-475-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-480-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-482-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-481-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-479-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-455-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-477-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-476-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-471-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-470-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-446-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-468-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-467-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-466-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-465-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-462-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-461-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-460-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-443-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-442-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-441-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3120-456-0x00000257B1120000-0x00000257B1130000-memory.dmp

Download

memory/3484-440-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3484-215-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3504-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3504-24-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3504-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4064-235-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4064-182-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4188-190-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4188-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4188-107-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4188-101-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4192-221-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4192-219-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4540-8-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4540-547-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/4540-2-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/4540-149-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/4540-0-0x0000000000400000-0x00000000005E8000-memory.dmp

Download

memory/4884-12-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4884-169-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4964-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4964-203-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4964-120-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4964-118-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5092-223-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5092-150-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5092-155-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5092-143-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5184-598-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5184-240-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5184-183-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5192-230-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5192-591-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5232-278-0x0000000009EE0000-0x0000000009EE8000-memory.dmp

Download

memory/5232-261-0x0000000001AA0000-0x0000000001AB0000-memory.dmp

Download

memory/5232-245-0x00000000017F0000-0x0000000001800000-memory.dmp

Download

memory/5232-242-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5232-437-0x000000000CA00000-0x000000000CA08000-memory.dmp

Download

memory/5232-640-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5432-32-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5432-62-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5624-333-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/5624-187-0x0000000140000000-0x00000001401ED000-memory.dmp

Download