3ccde8fd4168eca32da52cad9b4671ea483fc3b2eabf7271402aae513e49d50e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260604-rtj29sgt91
SHA256 3ccde8fd4168eca32da52cad9b4671ea483fc3b2eabf7271402aae513e49d50e
MD5 9a5142447cdf405596b81f8601c2bc7e
SHA1 7a737665e87488156b0ce151c01333cce1f1fa12
SHA512 9709abef1044f807dd2a63ab36a12c8465c1df02477b60d61349410aa17d40362fdba526297eae0788ba64ac8dc7f056ac06501a88501a0163698d9757bbabf8
SSDEEP 24576:TYJ9bxOrRCBq6gQ9awp0yfuKw81mI8bhp:TYJtxOfDeaa/fuQ1mIg
TLSH
T1E3550265B0C194B2EEB3453409B8DA71AA7DFD714F600CDF63A4276A5A302C0EE39767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5096	alg.exe
1032	DiagnosticsHub.StandardCollector.Service.exe
3944	fxssvc.exe
2416	elevation_service.exe
2224	elevation_service.exe
3160	maintenanceservice.exe
5276	msdtc.exe
5916	OSE.EXE
712	PerceptionSimulationService.exe
5484	perfhost.exe
2212	locator.exe
1144	SensorDataService.exe
1044	snmptrap.exe
3244	spectrum.exe
5464	ssh-agent.exe
232	TieringEngineService.exe
3880	AgentService.exe
960	vds.exe
1616	vssvc.exe
1976	wbengine.exe
2552	WmiApSrv.exe
5472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c020cbd3ee2c9d24.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000407251942ef4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c7ab6932ef4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f50844932ef4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	3944	fxssvc.exe
Token: SeRestorePrivilege	232	TieringEngineService.exe
Token: SeManageVolumePrivilege	232	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3880	AgentService.exe
Token: SeBackupPrivilege	1616	vssvc.exe
Token: SeRestorePrivilege	1616	vssvc.exe
Token: SeAuditPrivilege	1616	vssvc.exe
Token: SeBackupPrivilege	1976	wbengine.exe
Token: SeRestorePrivilege	1976	wbengine.exe
Token: SeSecurityPrivilege	1976	wbengine.exe
Token: 33	5472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5472	SearchIndexer.exe
Token: SeDebugPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2712	2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	5096	alg.exe
Token: SeDebugPrivilege	5096	alg.exe
Token: SeDebugPrivilege	5096	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5472 wrote to memory of 3876	5472	SearchIndexer.exe	106
PID 5472 wrote to memory of 1816	5472	SearchIndexer.exe	107
PID 5472 wrote to memory of 2144	5472	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_9a5142447cdf405596b81f8601c2bc7e_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1112

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2224

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3160

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:712

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5484

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2212

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1144

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:232

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2552

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 2700 2832 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1816
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 944 2856 2852 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bdcfe9ead3554e5cc5c6d97b6dd6d53501fae4329d1dc18b0d6453e287897d31
MD5 807af5b2b06e65d94a13174f5a07b139
SHA1 42035712aa5a1e2d5063c3c548d8adf39a392997
SHA512 1c72b32715feaf0c86d5ebe693749ba68978537409c849a089e3dcde50af03eed2decd794968499c19dcea164388752a9b891f4fa25a4685b9407cf0c0673d09
SSDEEP 49152:Pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFOfDeaa/fuQ1mIg:N3q6HjB8OfDeaa/Ve
TLSH
T1CCD59D03F2D900E8E06AD178D7469533EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cfd07860d248f2efc7db538b0876ef2d9b3e1450dc0b7e262787c0e524d9c181
MD5 d0d5fd72915084c921080602879600c2
SHA1 750328485f585331a76b921ceb0ae1c1828ea67c
SHA512 f948e0c18c1a7a7827675d655ae226e830e20ae78c2f844acb78f6a6c1d52a36b330d35c3f95d761c82c813a1340b8f1f96ac77217e04a31e2fb95d5cb9facec
SSDEEP 24576:aXYfDtczAQOrRCBq6gQ9awp0yfuKw81mI8bhp:BtcvOfDeaa/fuQ1mIg
TLSH
T10765F128B7E508F9ED67827CC8A1C501EA73BC5547A0E6CB03E499255F233C86E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 34c47d160774e75033b5d9a6c5b2b0ce8662da3766aa0c4c4236990aecda4785
MD5 cc3f026e28d7295b67c327b2b38238db
SHA1 670d59c89112bee60a614b3e8c6a7129bd4b2a32
SHA512 f3b4e1e9ae5ea29041ba80477f50f0f9019f97985ed0bca0d97540c14221afd2a24be9abda9d2231757c5e2ba4d68e9c860b5ce63424b4dda371f2b7222e4481
SSDEEP 24576:e0Le5ji0hmxirM9OrRCBq6gQ9awp0yfuKw81mI8bhp:ePji0AceOfDeaa/fuQ1mIg
TLSH
T1BE859E16F5748331D073C0B9C5D2A68AEE7230865B3089CB4296D77C6F677E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 93d6c37d62f5058b87222a3828795ca1d9a23a5ece660a3a52367ff3c18d6693
MD5 715e5d5030907ab8f7a43ccbfe3c187c
SHA1 cea13dab09d8d226607a9724fc240acc36302c0b
SHA512 0a35aafd844b8801e8236e1539aaf54444c85807fe6a70a6eaab5d6210cfb561539e24475ec8c0e62aec62e937cbd145905a7d01e20ca6e296eb82665e521ff4
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWE6q8wyufOrRCBq6gQ9awp0yfuKw81mI8bhp:U/ezSC6vUzPvxHjyCOfDeaa/fuQ1mIg
TLSH
T193755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c12982b20ec988c899e07904156c3287e3c1c1c4307b6930c7588dc810380b0
MD5 f65ec454dce7bbb1a02521c959179dd6
SHA1 ee482d31649e3708323e1c650d3c26472c004b97
SHA512 0c39d7f1710c42077d667b62266e479ae577afbfccc3eaf2482ccc06f6e4c49a89c865599041d0d614bb9e97b38a58e3e6624ca9ccc1937fdb85509f0da22e74
SSDEEP 24576:iVbqPb88hv/l+6sOrRCBq6gQ9awp0yfuKw81mI8bhp:iVO88hXl+ROfDeaa/fuQ1mIg
TLSH
T180559E66F5B48331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C2E677D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 855afdde7ee735c9218309ba2b01c2436b6f4ac32109888f0d3edd71731b5d08
MD5 bf1b0bde11bbfeaa6b881df81b6cc914
SHA1 7c7c11bdea7a57a722f9275ee1eb9f85e1544062
SHA512 3017db3474390aef6f7f1b5d797410c4344053e1eaca086ecaa79530fa3da30ced13f9067eee52eb06cdf2aa1008d1b3c0ce8ad0a2276d9c96f3e389095ab847
SSDEEP 12288:URZny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp:URZOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T17145238DF4A92480FEA797B85578DC82FAB9BEB44CD01C8689B4372681352C5FF1610E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 104c3a5fea93659b7d47011ecf8c78c50d5d81287f8d8c4f9f868680a88df27a
MD5 98c2eda2fcf86f21254a076fde92b6c0
SHA1 32751ef5904050e828e4101b2515283492aaab51
SHA512 54438259fa5ab7597818ba88dc040a78c7e8d98aedf99ad042fea0568081f597b8227016a3c6236a0e461fc63eeaf8a2a42a7ca81220197e29f031a5eed1a7d1
SSDEEP 24576:cJIUEOrRCBq6gQ9awp0yfuKw81mI8bhp:cJIUEOfDeaa/fuQ1mIg
TLSH
T1AE65CF6BED28FCD1C67A8DB85A91C640E7B278704F61A3CBD174820EDE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6ec7c9aa08606448e2e05248b82d81bc8cb6ca513fae3f5dae220d7e9cabe753
MD5 a21a47c6f1301b25e8bf1b013e93afbe
SHA1 9a8d7c205c06acf7e8d15acb48c15a0724d75925
SHA512 d60774fe0fcd2bc4eaa61970f328470204ddb9bfe58098199da156338aa9c19a64a6215d17ae62767e3e3514424bf3a3557e220dec9debb6242fc208f91d66db
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:AQvGAdlCEL8c/yRNw5CPOfDeaa/Ve
TLSH
T1FE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dbdab9b393c355498014b5c6b316032878a308e7cc33f98a7bd1e3641bbdb797
MD5 f82c096c946240fa23d1d25e3c500fb1
SHA1 9672ed31582e411389033d1a7def07033705f0bd
SHA512 1219a32d7fc869a2715b9a6b0ed308b46597fd81fc9d953a84301413168fbb51c6996ef5c79b2267ae3633903dfff5ae8269587833bb78c37b98fd491134847a
SSDEEP 24576:GdewsAjOOrRCBq6gQ9awp0yfuKw81mI8bhp:uljOOfDeaa/fuQ1mIg
TLSH
T14375E031FA74E432D6BB0DB61B35C706647CBA604F9119C3E3E85E9E49302C26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 deb1410b7e25b323d535c7262cd511a0ea64efb101688db9ee0e8c556a0aa479
MD5 593435367ecd404f149fd71ef7c0aca9
SHA1 fa72b1e1ca2f3f72b17a8d65fcbe96bdd54c8559
SHA512 d8d3836541ff5858afa114fb5ade339d67a1408cf3df3a120b1d68e8b24e6dd2e433000d6c1c799af40ae14bcaf776c26491e189320a6474dc49caca45507b36
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2R/:oUEtQevvqc2W1cpV2EI322R/
TLSH
T10A474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d57d80ef780c36bd58b354e3238af44cb09157d1e33da1266f6bd36f1c35b0f1
MD5 381ce346e4bb9cfadb80b210eac55ee9
SHA1 1dccc951f36a7c9d94c9f38efa388ff268610dcd
SHA512 f419300b26abe017b2f9b6c5b74681f75ccc55c58b359a125642662c723c2416b574e10c1967f1e64f75a65fefcfaef89ce45cd63d3767d21fb026780b7f20d3
SSDEEP 49152:PCbRquA/m2yL5zifFiV+XenmE3/zuOfDeaa/fuQ1mIg:IoqHVjnmzOfDeaa/Ve
TLSH
T1A6D58D0976B881E4D1F6C77886A2CA47F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a7926262b5ed0c48f8f17354b853ed7faa789f0aec2a8b0d4b4e9c0c2b1c9736
MD5 fe7b94bbd0ee28b1cdd277b02c21b2cd
SHA1 47d139511cded9ef5a44a82cfd188c02e5f6ecb5
SHA512 5f2099675efee5e33373ab698b1cd400068f25a1788996c86141ecbf603f16bda9c1a6f91dd0a380b653f49decd4dfd6b0ba503efc3c85e82d1945de60a01b9a
SSDEEP 24576:mAhGLJIFoiwtA5l7S53TOrRCBq6gQ9awp0yfuKw81mI8bhp:mAMyFoiq5jOfDeaa/fuQ1mIg
TLSH
T1A335AE80E7F955D4F5F3AAB899B69571EA76BCA55E30C20F2160D11F0E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d9b6a8b8bf0e894f7595522e02de14607cc21d4c09af105fdb7ee6b672859792
MD5 b6a734adafe03bdfc047a0b5e1eb40b4
SHA1 c1484209dbdb1190715c275239b4e90cafa4cb05
SHA512 647c62cc62eca1ad4bbf677665d0fbc94118e8151be50d4691c6bb45d2306e33d4428c5e9ac0c950608e1615caee5da19a7190df64b357379bc49b88ee510056
SSDEEP 24576:iwuoOWiOrRCBq6gQ9awp0yfuKw81mI8bhp:iwDO3OfDeaa/fuQ1mIg
TLSH
T14E65F14A76A41CF9E9A782388557C532F7F2BC112A609B1F1760C65B5F33351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 34cfde5bda460c959ab7ad5ec37f4e8cf868d68c6a58be080e86db4f839d43a9
MD5 c5fabf88adf458dff39160251309ba81
SHA1 b619be22827cc4f74416c50df41d24cbb91e29a0
SHA512 1b9a9abaa055fde55c67b43d7dd21472cbd1b172523460ff38bc283755b0fcbfd0d86d0ac6c7082b9bd2afdb791d3ca8523d3029e0a128e1eeabe5fa821540ad
SSDEEP 12288:fBZ1Iy+ny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpL:pZu1OrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T15455128971E420F0F5A3927CC9F49942F7B2B8B257B107CF166416665F336C1AE3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b6726c7d8a05f0104c80eef8914ef17d98b39c40ee2da2271795a5b08a49a977
MD5 44812c1faaacbe14903c582960bb5f00
SHA1 18ba73af69e68da64dcf8f726701e3f1249ff7ae
SHA512 2a56e0dd499272f1d9a8524533f1e0fd843bbc4af7c466debe2d5194e4bae26e86a30d251df279adadf7856f6da6081ad8ec3c23684086f128a2acdf7abf5e64
SSDEEP 98304:tQRQyi36YOcPQLvw2gAf+PN3oOfDeaa/Ve:EQyiKayX+PN4R/
TLSH
T14D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 842e6efecc5bc58e4855a969816abfd8e9fcd410b40b60ec77fb29a32c0cc492
MD5 a57815e3ea50fa115b5539026f5540e1
SHA1 ac3cb707ca0aee3d7e5b7a449e8d7b5e44d8b282
SHA512 0209ad03a2f8aa35ebb43d1b7228ce3a70e23a6850448a53b89ddb33d582f60e4dbdc21aa86efb3bd53330e7414c001829df9d3da8da79c7291f2340a3ec3e7a
SSDEEP 98304:bQRQyi36YOcPQLvw2gAf+PN3oOfDeaa/Ve:qQyiKayX+PN4R/
TLSH
T17D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 13744ce81ce8217794b4c6f3511bd50d7c34233d224302fe36a4401547cd9f55
MD5 9bfe096035da02aba6fc1ba2a2c58fd3
SHA1 43c39080ee70d61fbaed213478327cc61dddeb90
SHA512 62c17e3fec509d0b70b64fd38f133ac27bb2ec1fcc82274081c21a85405dc8d9f23c34879bd3bedde2068aa689dd5a1f83c2352b48cd501cd4415d67b45d674b
SSDEEP 49152:y68Qg55nhheWu7PNU3/eOfDeaa/fuQ1mIg:wthWRc/eOfDeaa/Ve
TLSH
T140B55A33B2F60099C44DE1769F4A872196E27C75CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 210d0ff6f624a38d1a51a95d1a0565984faa2f7f8c253bba4434325fbd693c7a
MD5 2565a50a5e0e4b710bcf28829333ba1e
SHA1 9f3d99477ad9f79511f2863eaf999e42d562c893
SHA512 1a4d400626b0c68a87b3649aaaa3522200ed994e1d278b6f853a093cb892ef05f6698130bf41f197bd79fbfaa724e662a1ff9b0de578efdf931060953dc24e85
SSDEEP 98304:Gy5112gYy5azzVvL69nLKnhZZOfDeaa/Ve:3LIHmWhbR/
TLSH
T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 21bd0cab686d4b41073ebd221942f184735d61520f84dd947522ddf1fa7d03df
MD5 ad7f9da59f44c85e76fc0e52af7c6c10
SHA1 eafbfd0be46dde05adacdfcf5763f7421e805c1e
SHA512 afbc10c6d185b9bf8e66f95c83f39730ea12586da8889e7581ec680526514a58199a391cb704ed4a3c583e6cd1e27664a7f97b9d5ea1d858f771faa6863493fb
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgOfDeaa/fuQ1mIg:pu6JmVxd2dgOfDeaa/Ve
TLSH
T154D59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d68a92c2b34354b4785707b7d5627cdf6cb1546a14d0083b3e7d3de419961f4b
MD5 1ad9957dc91aa526c49b3a07ea5b41bd
SHA1 34b5d494ab90148d6a5b27a0b8c8aeb848295eee
SHA512 0a329a816d78d9d39887249dac86f919791e22e71c70d702e6c527034b108fa4522f8801fef137dc9826079ced8c7f6a53bf6b4bd08a3713e4ea4d60994374f4
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xkOfDeaa/fuQ1mIg:SmifPbRzOfDeaa/Ve
TLSH
T1AFB5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 09af696f45a3eec851f3a65082ddcd7df24a945fbef5cbe693c25139da0adc4b
MD5 1be8d0d17fe46d9450f85afabdeac59c
SHA1 b482e61eb149e714624b9c419e4079b1eeba1fff
SHA512 38cde1bb09faf45f59651de9c095afb6cfd5a70db7e6f2bfd56a65d615f4032081b9e5175c7ad93fbcffde9ca84e2ab20aaa4b0d03b2405ca4565510873d5cab
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHq1OfDeaa/fuQ1mIg:W5dKTi611OfDeaa/Ve
TLSH
T1EDC5BE03F2E940E8E0BED67887659632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d60879ed08acd9aa7b673d1d1654a8a1c820a451dcbb15af67054fd04d608b74
MD5 8897edd5f631cd793d60e8162306d682
SHA1 b36448ea270f46e48369574ddaa61ad822935f9a
SHA512 899cf5e0c388c05543bc3a548706763c3557d222422395ae694a8600d761732ab2e84277883e00dcf0d0340c0b64a9113e8706f234b761d2128b4622485a64a8
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wQOfDeaa/fuQ1mIg:UX2iyphXOfDeaa/Ve
TLSH
T15695BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A9077561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0eb39ee38e5f8099b3f944099da706afed7d9982d26e77d49931c7a49bf05c4d
MD5 becae79a04136e7ab096a90bd18b5480
SHA1 55c8dafef0f45f93f2e38b03f7e6a5a755397af6
SHA512 eb98217a6ea7a95b9a4c229cadbd452e35cdad3df488760f511fd1a77e859946c251d19378444e0f066ed89426c1f2bcafa9666962605584d84d3d10bb52dbd3
SSDEEP 12288:uRny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpL:uROrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T15945238DF4EA1580FD63D7B89574DC82FABCBFB58DD018CA9A64362282312C5BF1614D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5e89b4f2b3ec4a3eca5209be511f5f9db5f852119e39b638d253421159000279
MD5 617bbaa57eaa495167621881261d2b53
SHA1 410885f5caccf91d187bcd09a6a05fb0e76f7350
SHA512 1f2a77bcd214fdc2ff4310e19b958180c93b76ba2bd2ddc263545c2ad5063c8345cc136b01620ed6700134167834b07bfe6b8c2e6c4ac2844071bb3231c59c04
SSDEEP 12288:pKny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpn:pKOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T12345238DF4AA1580FD63D7B89574DC82FABCBFB58DD018CB9A64362282312C4BF1654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5ec39f8b27eb896110092d3effa954c5c8d502498a41cbddf69a517c2d80746d
MD5 a5883cf61c10ab6607a4726c626cbebf
SHA1 581538f5f9ae151a5fd64c9bc8d4d69c160c3469
SHA512 ab792ae5c1e6bc7c0dc73c0d888be13b9da2c7f2cb70b38f2d0f15fb3fa77b92cb227727be2bf6a17b8b6cb6098a8ffbb0083a3a0cda910838b3df97ee140665
SSDEEP 12288:A8ny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpC:A8OrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1DD45238DF4AA1480FD63D7BC9574DC82FABCBFB58DD018CB99A4362282212C4BF1614D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9eeda32ef42bd952b32f2e4e5c22ece6a45892bba7f050b35f1fd88045d277e2
MD5 6a5568bfd514500bf0fcce75bdbbcbf9
SHA1 50d0bfdebd4335be782b7f556c09fa439114a697
SHA512 ac8d0081430de178646ee1a71fa79ce8b8f5e506f8d10063d8e04c7bbf96b669e8ea8c9db303eb00830a04421abcfcb637915fd204dc61dd0124a4626d1bd37e
SSDEEP 12288:wVzny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpX:EOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T146452389B4A914C0FCA3D3BCC574D842F7F9BEF58AA019CF9A6026164A313C4BF2565D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4117083d524f8be906a92ff8d887492a94a95806739deaccc29fb6adffec8e9b
MD5 90a306f62c06fec648dec1a5e074239f
SHA1 55f3392f9867269abc668110932b9e4401e59876
SHA512 b51ddcd0a5955b0a067e8fc5bdf794efe869c1b80929dd1f9650c45ba1766326b0235a9373671d114ec0def60c5454259b3ff453404675e3372596676f2662a9
SSDEEP 12288:67ny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpm:67OrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1E245238DF4AA1480FD53D7BC9574DC82FABCBFB59DD018CB99A4362282212C4BF1654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c111e4d4557ca4385b04f59f95440f6789a432bb098d95a1ddc8dc93a3864286
MD5 606e8f07438b3e8ab9266c13c831e1f9
SHA1 3eac66bf3f3d7aa5fbe21d57ff6cea43916e5b2c
SHA512 a4cb003758dced2978aaf2c4859f9e8da4729e159f87f6e38ae25f6dbec2b57e5b7f13c0b07229db955a4aa33b378b0b6b40b740e16dec285b582dfbeff998d2
SSDEEP 12288:cmny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp7:cmOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1B045238DF4A91580FD63D3B89574DC82FABCBFB58DD018CB9964362282312C4BF1A54D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 79b8e60d1e05a5ed6fdcef9fe2fc52b75238ed5daa260c9b395c87cae769a4ed
MD5 0f0c213563f23e5058d9340102e0027b
SHA1 db74b92fb683a6f90e7df293f0d71cbbdd17f94e
SHA512 33ef1f4e375b3ea28d2e9f61c49c039c05b75e2e23a1c95c7eef94c23c9ae6349a8629e9184ebcb1c9e81ea1c94703365162ff1750227963d06d3ab3031fc22c
SSDEEP 12288:2yny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpj:2yOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T15C45238DF4AA1580FD6393B89574DC82FABCBFB58DD018CB9A65362282312C4BF1654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 5cb3487e0e658b81de1aa12c82cafef3399104b1d0cdf85e1af8b9472d611a2f
MD5 4cd935ad10af2c1e60fec47d7ba9304d
SHA1 f51ab5a91d046278969b03621f2555b3ed8ec866
SHA512 fd349a43cfec972cc5f8ac611e42b44f7b15f88322d3e1bab4e117a5bea38e7e9b2b3a7eea6d339ee1ae2f68ba9c6421c0eedc483a189ef1577bcbf71d2979f6
SSDEEP 24576:cZMSzFVSOqOrRCBq6gQ9awp0yfuKw81mI8bhp:cZMSzfWOfDeaa/fuQ1mIg
TLSH
T1EA650299B29018F4EC67823DC9658D02E6B27C690BB0CA5F13B436275F333916D3EB59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6f75fdf16aa4301ecaf6c7ea12aa251eaa2d239b0abe69a8e7692fac01f659e0
MD5 8b76e4d964b834f5be40a8897d614479
SHA1 1911211b2f38a3d386bd398a1f8799dc5b3580a6
SHA512 d9d250dfd957b3535893f12f4b92527032e055fe98be39e3722dd8d59c80fc86932fb36c2f8c54cbec00f1629e71246addf0cba08dbb2a80f2e0613c9b191f64
SSDEEP 12288:Ylny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp/:YlOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1C345238DF4AA1480FD6393BC9564DC82FABCBFB59DD018CA9965362282312C5BF1A14D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2699f9d39fff1b3b90060bcf72c309ed129ae8fd6531d14b9928260ba7fbfb52
MD5 b44079ad94804926c76d073d203efc4d
SHA1 64f3f825d30009af9ee4bd2d1c4b291130b34c85
SHA512 0c9b2acb7f58e9bf46cbc1748a56e5e0282751a208c90fb9f488939fc1bd8cebbb4e9dc3b153251d3cd6f0eb287324eface015515eeae923658e0f04f0d1c848
SSDEEP 12288:mJny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpj:mJOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T14345238DF4AA1580FD6393BC5574DC82FABCBFB59DD018CB9A64362282312C4BF1A54D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a380d17fc1c4a482978dec62737ae1364c95609b252ec356f20c40365c66d7a2
MD5 3f2f0349b152bc1ee0cf636d6b6ea02e
SHA1 7c5851996920ffbd553f65424e2a1e2d1021123d
SHA512 cdcaceb087748e5a2ea769a71c7523a08e760b5a6f039b068d0f2b867dd72939a4091e2493c7925997544a3c362f848bf6d53a671d3f53d62154d7d9ea2a94fb
SSDEEP 12288:KyPz5L8+ny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpg:Xzy+OrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1F555024BB2A530F4E5778238C8A15D42F7B5B8724B604EDF57A417761F232D0AE3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7d0bebf43575356a86877223b1398528e8da3b7cfc749abffb32dad4e9b3cb30
MD5 49fd174d78da3b3f9139906e7975450d
SHA1 fb3cd48106b23e4d7fdb491f920f9b7967898455
SHA512 f55a00814f33145c9f8e47ebab8584a97c682eaa6d3c03a39869b877ac3228065668ab1a39b26a8971cc1708d234c1943ab15c9939993edd0eecc6c386abed90
SSDEEP 12288:xlny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp8:xlOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T19D45238DF4A91480FD6393BC9574DC82FABCBFF59DD018CA9965362282312C5BF1A14D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0832d3daec191f41aa6e068c2d48311b5a4057c315025933dbbe084d740ce453
MD5 820f67ae674d406476a00ab119657e04
SHA1 9917292bf86d282ce71eba34bfd3b70e5aa0e9c9
SHA512 334ef24dbb1a2114ec5ef9175358897d56572a57d4ab4db0489cc3073c0dde9034ce645a86cb962f2485203be5798f21026163570ef9ece0947513c2fb089533
SSDEEP 12288:1lny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp0:1lOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T13F45238DF4AA1480FD6397BC9564DC82FABCBFF59DD018CB9965362282312C4BF1A14D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 71abe6a6b50a7f7b7706bd164ad9abf2500ab720789e668b97db0f47fdf86b33
MD5 8a07c8f5ec66510a221762f38a47f6e0
SHA1 48c63efdfbcb92c67ab1ed3d5e8af934cdafc7ca
SHA512 26df6623a72ebe06cbdbac77fb052ada198edb964831363d038729f60850e4a8b1b9483c75084e2294b9c8b2ef400e836af73b66214ab1c892f1d6666813c977
SSDEEP 24576:kCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA4OrRCBq6gQ9awp0yfuKw81mT:kCUxPTY+8Wg2lIL8lrIUJLWw7OfDeaa
TLSH
T1D665AE1DA3EC0896D4BB81358A518A06FB72782E1B2196CF2170C73D6F27AD55F35F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2db36dcfaa45c8d1b02e7c4c8796f176af0d67a190640af05679145dae4c789e
MD5 ea42af21a2c496f0fb69c320d3f1f8f8
SHA1 898db47fdadf4f16275f9905ad5c50eb481eee26
SHA512 655952dd5ff49bebfd0e39e52f19d3684f0594510f952098e572c2f223867a0ced327062cd53e24691e42ff57d1ef0e797b0d02f464c8ac01924ae621fa68e35
SSDEEP 12288:bNsf1ny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpK:Y1OrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T19F55F049E19802D4D4AFA278C7658A41F7777C6587E092CB56D0F63E0F362C0AEEA707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2696b3014b6125f4e77b417a83564ffb22a5e27eef4a703c1d53f13589d902f1
MD5 e67e099df3bd227bc412571f2414b9aa
SHA1 df91b8cd7f50ca9983e1c7b7971f37dec68d9e34
SHA512 10fd3b2f2f4419581cfb520778af4ca7b5f42a26ecff88eee1d9ff0d3429f1eabbe12308f84b2eea91503eea185bda8c8d23b5c77f22545e81d118d936c41279
SSDEEP 12288:5cny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhp:5cOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T134452389F0A91940FCB797B85578D841F6BDBEB44F9018CBE964366292312C1FF3660E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1e4ea1774b5b801534b755a4770219373f22b19e61f67e5aa1c072b52b23239c
MD5 201e23c7f12786857385c571d394c7f2
SHA1 83ed859af5d68d29c10ba273714a8abe8305fb50
SHA512 fe9fc2654ada3c76b5e09643ea5d6934971c09cdf1366083b66c3296f766b634c22b92fc6405849cd532670997714e861078dd69ac5b0978a37a9424762c2983
SSDEEP 49152:pRZwQCyiHiQEaiPnMdOfDeaa/fuQ1mIg:j9xPPaOfDeaa/Ve
TLSH
T12185B01E62DC46A4F4BAD2B8CDA74407E6B27816473197CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 2e4801ec574038b4d470535ad11c25d67222b0b3ba5e46b6377278b653e674d4
MD5 eec9da62b88a1373f730066328714f74
SHA1 9d83077afd679e570f5992a3048257bdde3419a3
SHA512 ef34a0cd74e86b4a5a608da1643d78b7cf108036aef57cf2482ab17c22be5401350f2e9dfb5673bfa16241541d6632abc9445366535da6af5c2249c8f224f54f
SSDEEP 24576:JbxA1UGMOrRCBq6gQ9awp0yfuKw81mI8bhp:JbxA1UROfDeaa/fuQ1mIg
TLSH
T13855125EA0AC24E0F5B7E27C89A4C502E771BC76176057DF10E0923A4F37AD4AE36B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 24de1251c8db5a8c8908b95fa35356b212bef4452be38bef9485db2fef0c686d
MD5 9987fb0561dea07a0416fbbc23199f9f
SHA1 771fb3e4c64747bb70976004ef9ef1c8fc49b25a
SHA512 0e36739eb3d97f4ffc3793bc5a2da34000cfa09520b3e52acef7a84229a68048117ecf5cccd6b0788c9acc29a2ce9f577076d3dd301df5bb5fe96889f8c37edc
SSDEEP 24576:yjsmP0yHaqrVqHra44KDzMsrnjOrRCBq6gQ9awp0yfuKw81mI8bhp:yjRP0yHfVqzlAsrnjOfDeaa/fuQ1mIg
TLSH
T1D045AF2EF2B910A9D4AAD136454107B5FB71B82D1F209AC70170C635AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 d100fe73c30b29860cf6f50f1e569449ade7da3d368432d2de6956d17dccbd70
MD5 90faf471a10fda44fdf386399a480c6a
SHA1 dfbf84c7dbb031e7c2c97faf2d718413d399836e
SHA512 d207bc2bfbe5bb1d8581c33ffbc94c2a91fc71cc6a0636470ba6015f05ce15067053be74da6ba1fa1655777923edefeae597befb1035c35f96e8b60e8adc83dc
SSDEEP 12288:/Gny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpD:/GOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T1DA45238DF0992980FD6397B85568DC82FAB8BFB54FD018C798A4362282252C5FF3654D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2c0080d68b2638dd4749dac2d8d28cea157c75640cdc77fa74296b2cc6b91480
MD5 7d7ba362ec3db29d9eeed0d5e7b896ff
SHA1 c53f50fb6cc3872ae478173cd8463f5f78090ade
SHA512 b6f902f7d3c7b20a2b6ae341b0370c653ea1c1360dd235eff735c88ae7c8cdead9dbbca04c109837ac694a91f2315891fbd011693a3e1ebd3f975e643bd4102d
SSDEEP 24576:5pLBUTQOrRCBq6gQ9awp0yfuKw81mI8bhp:5pLBUEOfDeaa/fuQ1mIg
TLSH
T13175F159F6A400F4ED77D23CC9668912E6B2B8AD0760E6DF03A84B651F133E19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 04e5434805272546be3139e93b267a8e6bd760529b2906902dc95a482cb81125
MD5 1def9a66bd7f7b57b44b98bd754a72f7
SHA1 6597cc42a5b8a5a8aaead1f7a2d77f57b9aace81
SHA512 327c75adc1cf74e2c1bad16a4e7bc84246500296cc5602c8cd556ec0417c1626136aae7aa96184a143e1d273145ec2f98c0ce7ab861a4c0e14aa458d247596e0
SSDEEP 24576:ArYNHHOrRCBq6gQ9awp0yfuKw81mI8bhp:ArYtHOfDeaa/fuQ1mIg
TLSH
T19865F11EA1AD1CE4E57BA17D8AC2C605F272B8A6075156CF05B0837A0F13EE8BD3E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d1a8e262224de02a7b80e96073a2251cdf5646849c2ee5db20762872c46d1c93
MD5 394c98af54f2d4cf5ffc72ce8c1bb141
SHA1 1f5b08f0a655e66fff317ccb146685f99a4c0fb3
SHA512 df39150f59fe597b68837e98493a4354b8d5e99781a54ccfa2a40988a7c60e3c7a66782b59b1778132f8f2fd1880154eab1cec7eb48ef3c8b78ed344266b91e5
SSDEEP 24576:TnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKt:TnXoJJYH84VVS6AmEcJas+cHBjSSKHPd
TLSH
T12965C09DA2BC04D8D5BBD17DC5C24506F5B178621331CACF026182BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b1fbe188dbc7c2c38e6ba0a29cf1fc55c40c6c2223f47d167fb62b7ec8e7c262
MD5 b6c0185a2b7f6eca9d60c03f2c6f54ee
SHA1 6f9d9ef88d1a38767839199eeb5ccc15c51e796a
SHA512 ac6da6c0acb9b31c8abbc1a526affec8a38ba710811421b40c1494b7f7c8809efecda76462e7d6f3917661e63006f93cd51f7bd6d10a760d6783312d91dd0d46
SSDEEP 24576:tv7Xbxd9Tuycf8M/TYlSuxrr2PC5OrRCBq6gQ9awp0yfuKw81mI8bhp:tDLL9TuJ0M/TYj2PmOfDeaa/fuQ1mIg
TLSH
T10A858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 80d1fd7f16ad130f8966c8a7dcb00c2874e9d20875483d8e7a220d1ad71c0f78
MD5 a2daa116e8bdb0e8331861638ed101e8
SHA1 61979ae7d5ec6cefbd8eb5a12e10a17666f6f604
SHA512 fc6facacfa4e0e135688dcf1f7eeda65e744ae6559fe3eb1973fb5c9e0fee1c563bf60b203bd50ea4f5cc4119ce1241f38c0476287a6a4815d51ad0e16c5631e
SSDEEP 24576:5egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wQOrRCBq6gQ9awp0yfuKw81mI8bhp:5ngOJOmPOHhQOfDeaa/fuQ1mIg
TLSH
T15855CF3FB6BC15D5E07FC17D8A968806F6B1782603255ACF0560827E5F1BEE46E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a81389149c9fe6d171d1a39791f9d14f883aca3414a592cb6edadbeffc0c10d1
MD5 4d5d6696a8fe5f54ac300c0f7ea11223
SHA1 481b02d8165a65ec02bda3d5ec19fa3a5ebffe36
SHA512 4c97df1f7512f1957f9784e4e427967551593b63b7e15b17e502b71c4684d7661eef235961dcd7ef2c9832ccdef4ea0926d78e65fa24d6f0f02242923d420e0d
SSDEEP 24576:RLJnJiTk3R3waE4JrOmOrRCBq6gQ9awp0yfuKw81mI8bhp:RLJnJK8R304lzOfDeaa/fuQ1mIg
TLSH
T11575D06CD1A810E8E4B7C2B4815A5A96FF71387C2F2169CB59B4D5313F12FD0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4120be17e695adac7cdcbd0fddb94f987c8e20c204afe4f6c5331ad7c6b26240
MD5 bee153e1b6ff40e8c62ffccd9bdd174a
SHA1 64fc98caa6a46220d77d9f8349e055635697820c
SHA512 863dae41fb9dc85f72abe2b8a8e480bc1c1f20d8a1a140f76fe8e07143965074954c0a2e627176240aff56e9740afe50bc17e3a4da69777c7ac4b93293fc87f6
SSDEEP 49152:I9mqCzDScAZmlvTcFg8Ph6yOfDeaa/fuQ1mIg:anOfDeaa/Ve
TLSH
T15A955C05F7EB5298E8B3CAF1C96294159B327C509B34F7DF0A80CA6A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f196091038bf0edf2f48528625e602f4983660aba5b9761406f08e1d108820b8
MD5 12e216865d38db56ea818aa9372e2a4f
SHA1 a905465cc602537b7433b694025f637a83c55970
SHA512 4ddc1b4ba22997b180f3fafee27320e0c2a449753b4eca865d7ab8a63d26c2ce04883b2ca70cc438c0a197c13f71ef486cdd840ee218d7ae8b3bf46951a41c22
SSDEEP 24576:blYJeXm5jUuEAOrRCBq6gQ9awp0yfuKw81mI8bhp:blYJeXmRUuEAOfDeaa/fuQ1mIg
TLSH
T1E155128DB4AC30E0F56B927C85A18941F3B1F4B117902BEF55E0D27A8F22AD57F39A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 054bb00d5ccb34afb9873d8dc0dbe53925e5ca502ef289bdfa5e17ad35ab5015
MD5 f6aef0255cf80515ea723ec50fe68700
SHA1 e5510b6dc258d06bcae73d4cdf24657fd09e5705
SHA512 6dc6a0cc18bfe7289dfeee097184dc39fccee073edfd38ace1220694c6f17720c7bdbd0ada581f0acbbf0d31cf1488da38688b7d5e1c4a23df9a04342517d928
SSDEEP 24576:Q7tyDOrRCBq6gQ9awp0yfuKw81mI8bhp:Q7taOfDeaa/fuQ1mIg
TLSH
T135551248B1E42490F9B646789A728581EF79BD704F6016DF95E0B73F5A327C0BE31B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3cbfa66457aaed164f3afeec18cc0d869aa5f861bc6dd0fcf27c69e2246cf852
MD5 0306aa9853635d4a737565bb7edd812b
SHA1 afa464ced33523d3ae419031ca266f60abba360a
SHA512 34c6f5c012e8a6973c853d48bf804418f6826c506782c12e239901b4fc23b687d62f761f137fcafaa05edd08771f503ecd0ebe703da0cbc4003b77d80b802e6b
SSDEEP 12288:HPQny5+AF5ieRvqBqPCk3LU9alKJ3Z0ZkMETyKKHYw81prMIpqnvbhpN:vQOrRCBq6gQ9awp0yfuKw81mI8bhp
TLSH
T13845238CB0A92480FD6397B855749D82F6B9BEB44BD028DF94E47632C7212C1BF3694D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c3b516a98c38cb9217f43787cfd385ae5838a52a314ed1d180e862e5bab43c3c
MD5 4a664512cd9394ad8bf81c74345d2a7e
SHA1 bfc749bca31a4ba5af262bea886e4cd7ce98b9cc
SHA512 7d2489088ea48827acadcc06264000bb78618382a3829af6209e34ba4d10a66ba913278990ae8ead9c2631ed093cc69c1e887fd9cde21b056dee2f0f58498a9f
SSDEEP 24576:vC+TyQIu93VAumZr7jmVOrRCBq6gQ9awp0yfuKw81mI8bhp:v/TfIq+YVOfDeaa/fuQ1mIg
TLSH
T1FD558D1DA7E91DCAE276C675C8A34493EA33B872137186CF2044C17D499EEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 14d13fae111f28ddca3bc33e8086e2ec21cc91d59d4248951cc923b10cad447a
MD5 258d5d9f167d02cf10f0ef3765f791b8
SHA1 bc8720481a7ad05febe6fbdf0a85168658ba0ab1
SHA512 1f6e1501922652b785581ab273d1eef7a6a6f913771675bfeb71ef5bcfec08fbb73de97965d5ddc871c8ea58ec3e092b31585ae5a88b5b89d9867fe3ff20f97c
SSDEEP 24576:MLQikZUOrRCBq6gQ9awp0yfuKw81mI8bhp:CQikOOfDeaa/fuQ1mIg
TLSH
T17765F10FB2AE1091E4A7C27C88958542FBB3B474475127DF42E0C77A4B676E9BE38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bba0c5ee353bd3f40112c05547d1dd9f24a141e6e9ccb0d4ac2e4fb0573e6de6
MD5 62a8e3f8cf11a42f9d545d21cf7bae07
SHA1 f262256c6292fa86aace2be3ca5a4c1bda637521
SHA512 15ec629acf61f4c2fccd1b6b0ec88371ec9f626682ecfaa20b811026575db1331688bf7171858c2529da8da06c7661919fb42388dcb1736e1cbb4d92e4d16442
SSDEEP 49152:ppJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPDOfDeaa/fg:6pC7b4+80GTk6OfDeaa/Ve
TLSH
T15DA56C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6c36de7ce43fb0e12285b80c500aa2dec2bdd80df8bab732618bb8ba65e831d3
MD5 5203b46882e1b1a61ce8649704ede4b3
SHA1 98cd2e1d9c0c2e719f224428bb571ce8c5b56497
SHA512 ad2ce5f7a755657153dbebd167e8a9eb82381cf8eb1492cc7394a5ebf42792f161770d899fa367b810a02bd93458e0953b3219c232861beab114809aee6a7e9f
SSDEEP 24576:ASAwJPE1IDAo+4Kt+l44135UQbOrRCBq6gQ9awp0yfuKw81mI8bhp:AqPCIo4Kol4/QbOfDeaa/fuQ1mIg
TLSH
T19555BF1AE6F956E4E17AC7B4D663C501FB727822133163CF9290913E0F16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 283f11d38a4c2a93132780c989a45987075980a8ceca5ce878ffcf545402ae73
MD5 30a3ae00c947918ca03cd03f8b257e71
SHA1 a50deb68172ba780a4d700633883d74c43e3292a
SHA512 91fa2889f476fc5e5894b4c67ddfd7b0837ddbb999955c373a9b91c533d23e4881927de97717a60e9785c9b1b5a6f706822d993592c0eb9b42f032c24271d950
SSDEEP 24576:EyLXPLcM94tLOrRCBq6gQ9awp0yfuKw81mI8bhp:Ey7PoLtLOfDeaa/fuQ1mIg
TLSH
T14475E13EE66D04E4E47AC27CD6A38906F6723CAD037165CB15A091791F6BFE4B939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 f099f192f2cbd92faee6ed72189ae99bc9667b8ac19fd2ec2698a2857130a53d
MD5 685a2768159d8bb4bc8eddd00cc0b974
SHA1 8b417139a85b38b03f8108eb3076f45242031cdb
SHA512 a43ea907064a5843673c1c7185200796c42f685a29982e533f1b11b015dd9c3e9808da3936d0f4eacc1459078dd8014a54cfeca7c3bed40820ada8c0ef2f26e3
SSDEEP 24576:uWv8qjpkOrRCBq6gQ9awp0yfuKw81mI8bhp:uWv8TOfDeaa/fuQ1mIg
TLSH
T19765128EA0E424C4F87A8378D535C552E1B5BDB607A029EF74D4A6774B316C0EA3EF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-200-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/232-209-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/232-206-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/232-447-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/712-238-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/712-123-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/712-117-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/712-126-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/960-226-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/960-474-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/960-235-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/960-232-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1032-33-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1032-125-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1032-25-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1032-31-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1044-168-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1044-336-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1044-170-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1144-476-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1144-150-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1144-158-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1144-156-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1144-478-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1144-275-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1616-245-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1616-247-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1616-475-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1816-497-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-495-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-484-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-485-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-486-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-490-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-491-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-489-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-492-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-488-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-498-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-493-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-494-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-487-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1816-496-0x000001F992730000-0x000001F992740000-memory.dmp

Download

memory/1976-479-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1976-258-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1976-252-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1976-251-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2212-270-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2212-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2212-147-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2212-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2224-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2224-63-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2224-70-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2224-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2416-58-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2416-60-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2416-52-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2416-182-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2552-271-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2552-480-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/2552-262-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2552-268-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2712-1-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/2712-6-0x0000000002450000-0x00000000024B7000-memory.dmp

Download

memory/2712-82-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/2712-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/3160-86-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3160-91-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3160-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3160-83-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3160-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3244-374-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3244-183-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3244-180-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3244-174-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3880-224-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3880-222-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3880-220-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3880-217-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3880-211-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3944-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3944-37-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3944-45-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3944-50-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/3944-49-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5096-89-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5096-11-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5096-19-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5096-18-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5096-17-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5276-98-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5276-90-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5276-219-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5276-92-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5464-189-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5464-188-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5464-422-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5464-195-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/5472-276-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5472-290-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/5472-306-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/5472-325-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/5472-277-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5472-283-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5472-481-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5484-135-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5484-130-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/5484-129-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5484-250-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5916-103-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5916-110-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5916-104-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5916-234-0x0000000140000000-0x000000014020E000-memory.dmp

Download