2ff96a3984517f7397a50c4cab359114660097110b08abb0b0259942d7c1796d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Size 1.6MB
Sample260701-e1k7pags6w
SHA256 2ff96a3984517f7397a50c4cab359114660097110b08abb0b0259942d7c1796d
MD5 70c9ca1f15a1f35a5e4adc7fae24457c
SHA1 26b22258f6943e817a5045ec0c6b8fd6d4b6a351
SHA512 0ea2d4124b3d843713293a9be356fb9ff6ce648459c8b5b79ae35d601377ce99296cb6274e28d0114f760184efc2608af39900a0e10187e4d35fc84ce97d5c1f
SSDEEP 12288:7UYJ9biSwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+O:YYJ9basRjhm0Ijr/eax8JXO02q3A
TLSH
T14275022172C090B3EA73487009F99670997DFD724F205DEB63617BAA5D342D09A3DBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2652	alg.exe
4420	DiagnosticsHub.StandardCollector.Service.exe
1824	fxssvc.exe
3528	elevation_service.exe
3380	elevation_service.exe
2228	maintenanceservice.exe
2320	msdtc.exe
4172	OSE.EXE
3336	PerceptionSimulationService.exe
1816	perfhost.exe
1544	locator.exe
4372	SensorDataService.exe
4916	snmptrap.exe
4288	spectrum.exe
4668	ssh-agent.exe
3344	TieringEngineService.exe
2112	AgentService.exe
5100	vds.exe
4524	vssvc.exe
2824	wbengine.exe
3556	WmiApSrv.exe
3816	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ab8a7632905883c7.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\UnprotectUndo.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9ea19891109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f13eac881109dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000943828891109dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b19949891109dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df2e5b881109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7a0ae881109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f29b0b891109dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	1824	fxssvc.exe
Token: SeRestorePrivilege	3344	TieringEngineService.exe
Token: SeManageVolumePrivilege	3344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2112	AgentService.exe
Token: SeBackupPrivilege	4524	vssvc.exe
Token: SeRestorePrivilege	4524	vssvc.exe
Token: SeAuditPrivilege	4524	vssvc.exe
Token: SeBackupPrivilege	2824	wbengine.exe
Token: SeRestorePrivilege	2824	wbengine.exe
Token: SeSecurityPrivilege	2824	wbengine.exe
Token: 33	3816	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3816	SearchIndexer.exe
Token: SeDebugPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3284	2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	2652	alg.exe
Token: SeDebugPrivilege	2652	alg.exe
Token: SeDebugPrivilege	2652	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 1408	3816	SearchIndexer.exe	112
PID 3816 wrote to memory of 1736	3816	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_70c9ca1f15a1f35a5e4adc7fae24457c_amadey_elex_hellokitty_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3284

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5092

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1544

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4372

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4288

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3556

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 005682f76ce91813442c1620382eb9a1f8b02c59b8223d2341e7624783773504
MD5 bdb232e269dfdac89325b36a5364b9c1
SHA1 0add0de2b833de73e55fd616e28b6281f01f6107
SHA512 3be00f1efa49ecced9bd9943bfe8396bcab3b042ad4d49c9e51ae75242fa88826884ae87a9820e14841b288b0ead1162968628e0e62878d14204d260ce38a637
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuEjhMjSax84:13q6HjBpQWdO
TLSH
T14ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3d7a7f355f290aebcfae9fc2b9e741d7b4a1fa8653c21337a596ac7c04cc42a2
MD5 a9663c451cca75fba7b62e008aada375
SHA1 1c3b231e130551d65a96fad87f788ab2d310da82
SHA512 3699a25052dcf1257e0389d9825ed579c8122bb5bd6ee25b5a9f0c64aa0aeab46cc85e53fd703e25a161c8c99107047f4fa25c9e310c121207826cc12effd1e7
SSDEEP 24576:hXYfDtczA1sRjhm0Ijr/eax8JXO02q3A:ktcsEjhMjSax84
TLSH
T12D85022863E409F9ED67817CCCA28505E673BC554760FBDB03A4A92A1F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 46a83e11274502af85b1f2b4da0c42700270646c118bdb4e5c48ce7ca3cb69b1
MD5 7062d2d11ec6f8dc21f494eddf03a545
SHA1 1b72b850c0df98275050367f1284db6b3ff99c47
SHA512 8cb0f7f5b5720457e5ec76d8b174023aa6f3bb23bcbb236fb8a98678f77358f978965206179aac0ef3a0b155c1d3cb59b9096c338d4f6788d0952bffa00420e8
SSDEEP 24576:50Le5ji0hmxirMmsRjhm0Ijr/eax8JXO02q3A:5Pji0AcfEjhMjSax84
TLSH
T12895AE16F6748331D073C0B9C5D2A68EED7130865B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5afc9a8757ee255c88462c4a985188f561bc1dee300b69b69950ce0b5256482b
MD5 3b26cfecfa18e4da53021fbae1ea5d66
SHA1 237df4cef48b27bedbefe51cbe2db69b77aaf79b
SHA512 bb9ec638de5e83c7152719940c133c8589033f345140f54c53b1d93ce6e7d1076c5f781d8bb7fecb567b2ed153fcf7fad53a6ef0a79160e83e19fa4a4aae67d5
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyucsRjhm0Ijr/eax8JXO02q3A:m/ezSC6vUzPvxHjyLEjhMjSax84
TLSH
T183756C25F5788323D0B2D0BAC5D6BA99FE7230464B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f4a7a0b792afcb37673ad19e653d31d1366eedbc625ed72886811060ea6bd87c
MD5 3b28dac716834e0330dcebf4b0b01471
SHA1 89ce69e15b499733cb60ffb86dce696b5ad2891a
SHA512 a6692e5028369bd23cc3bc9a7d205760cbeff8cb6105122f0676653db3af813ff119a60ee3ec6089f4f2d1e75c48bde4026dc092b6508991bcf79226e002049e
SSDEEP 24576:UVbqPb88hv/l+6ZsRjhm0Ijr/eax8JXO02q3A:UVO88hXl+yEjhMjSax84
TLSH
T1F7559E65F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C3E676E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f94c243adfe1e09788ae7277dcb2acb004d41d83630d40b3210e315cf42c266a
MD5 b5b5488f14a253f8c41d7810bec6b108
SHA1 e46c3c76276f9344598a70fefb63da490a9df65e
SHA512 d5ad9f37cce3bf191320339f6efa8accd8665ee349986b134f89bb2bc53154c14865828f67414220ff216055cb03f0afbec9d0f6ec70650bb0fa41e7a68d88f7
SSDEEP 12288:CRvwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+5:CRasRjhm0Ijr/eax8JXO02q3A
TLSH
T13F65235583A42282FF07DCF09C9B1808D45AEE694810BD776622BD6E2CBC4FF965F943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 ca6c0189e49d68d6ce11f04a9c37eff272fbbcf79ab424f83e889c07c91e65b7
MD5 534a3238f79b0d80177412a1566b4507
SHA1 ad74881b2da15c95c3eabf96114a79da07e5aa47
SHA512 9530f58447d6ef922abc2a41d5b5418557521323390caa1edc909336978039e7a2aa5cf2c9613509451087717b55acb1fdd70082855950d8f90b9858b3b4725a
SSDEEP 12288:0eBNUbTVO86UMwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+H:0JIUxsRjhm0Ijr/eax8JXO02q3A
TLSH
T14D85CF3BEE28FCD2C67A8DB85A918600D77278304F51A3CBD175820EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a1a6350beb1c2e1e23fe2ebe2b8a94788a6f09301a6157bf83b88d3d5e858856
MD5 9244e2b53e67ada007c6489bc9ca5961
SHA1 8916b03787d390223e69d9c32f352a53e58a32ce
SHA512 f81a69d73341b6ebf5d184997df9bc0528a1fab4dd24daa7cc87e2a487f83d2d047b56d143e9ed25f187bd6219d5e0a1206108946d3d7e064dcc2e326d14b15e
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THz:/QvGAdlCEL8c/yRNw5CMQWdO
TLSH
T125267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 68e6dc996f88f7f0cc167a3d5fdfd54ccfafbfd7a9c2fbcbff30496d5118f600
MD5 2cfb1b1a81cd942c6f5011fe840ab299
SHA1 0826e2ec2e3784e703e3c28d547905721ffc7081
SHA512 7e1de24f309254aff606383bf18d1e00ff155198eae31cd31eeed615d1f423392bf4d7208ed006faa819711138a04769f92408d6ed03fe2b60942c8cf0cb4f6e
SSDEEP 12288:2AwSfxL/2Dc34DLLmt0LDQewsAj2wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZD:LdewsAjPsRjhm0Ijr/eax8JXO02q3A
TLSH
T13785E031FA74E032D77B0DB21B26C706547DBA204F5129C3E3A89E9E59742D2237AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1510d4e323fe457c5b99437c03a130dae2f6c32402ca594ab9ef5fa45b631fd9
MD5 b250381893016dcec4af361c6630aac8
SHA1 6884be73593b2262310019f0be15e27543bd03a3
SHA512 187ce5bc2a5f4d598c2da0c156a7acd0f1d9c508186d8a3ed146d25a006cfc9e40313684f9f015c1bced84f437aa44261bf9404c9f76adc3437802f06f8d22bc
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXQW:rUEtQevvqc2W1cpV2EI32g
TLSH
T12D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 49eb9ec71f0e1a60ef54e716a18c96d05a260b4decfe1e151f024b7d3491cacf
MD5 70e4353e95ab589c1a6c0eb262064441
SHA1 597c9fd1fb5232c8e76224e6bcc70bf2c5fd699f
SHA512 c89a796b8f6ec8b036b0ce592e8a9aba0865d7c4d4633d536ffdfcf679e2f3b0d0860155a16fe68236f61f5e233bb28d43ddb6d4e4f9679778b5e780366c2582
SSDEEP 49152:qCbRquA/m2yL5zTfFiV+XenmE3/zvEjhMjSax84:foquVjnmYQWdO
TLSH
T144D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 925e5cf7e29481ade47201aa6445e71b1c499d83380a767db68247a18723b32a
MD5 65e176f54cd17ba02db197bb3f77c934
SHA1 4e6338b2c8895431ad9d88145c90fe1f59ba7e72
SHA512 6a1d1e715a89112d312fd6c4abcc54073e02135a21db8fb5f7e317141adae6cd48e39ceaaca7e5803b995c2682f594152733e300b2bc73b72a37e8ea201e1591
SSDEEP 24576:RAhGLJIFoiwtA5l7S534sRjhm0Ijr/eax8JXO02q3A:RAMyFoiq5IEjhMjSax84
TLSH
T14E35AE80E7F955D4F5B3AAB899B68170EA76BCA65E30D20F2150D11F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 505ecc69a36f638426c409c318791b208420f353dad6da704ff548b1bb9565c3
MD5 6f29f80c16ee521979c18627b2873b82
SHA1 a3b91ad0442563226c51581e6683e0880522dd3c
SHA512 0d1949116af1cebc2b003685f78a69e739fd14cdd5b6e6021ac19707e94fe27f479c352175bfd498dfa5253357269479e05a15bd9131936072abf45ee05377d7
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+C9wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:zwuoOWrsRjhm0Ijr/eax8JXO02q3A
TLSH
T17285F14573E41CF9EA67857889978135F7F2BC022A21DB1F1360CA5B6F372616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5ebf2474996a91fe27287b012dbf7241bf950a6fafed7b363b53aaf5a6ba5826
MD5 7c8327315d0387a69a196d241d165c35
SHA1 6cfe20afbd9f5c60e56a2dd354d9041e590cb211
SHA512 fdf9ee815f6cdf354fa80dc9d062efbaf53062a27459c04aabf86a4c9610e3a881172a15de7d68979c5f2b723dcef1fb8508ad5d57afbe31685fb60ba7a7e4e8
SSDEEP 12288:kBZ1IyGwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+w:CZuesRjhm0Ijr/eax8JXO02q3A
TLSH
T17E75125923E431F6F65385F8CCE60504D3B2BC66073153CF16216A6A2F76AD61E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a0fe8928577d81e1e7587e46b331c0ef4e9ca30c79a1dde4dc4ab90150aafe0a
MD5 dc6056ad538b548dce4a3d1a4faa4715
SHA1 9e02306d426515b8401288e6d495ae9bacbfeb47
SHA512 1dae1a127c2d36e1fbbff275c97aec22df3471ef9b31e3ce0a9b44df3828240d4ec9b3b1e57491bcb0e9027198b4128b76e24febbb2a260648221e778092901d
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UX:ZQRQyi36YOcPQLvw2gAf+PN3NQWdO
TLSH
T1EF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fdf9dbb3026af56e1c841a47fb5c3a861f70dba2e56dbee05031a94a5477bf0b
MD5 1c224655d0b2e7f96e39c3580308beda
SHA1 511c5f39ae6454d370d6d3e167de208e3d73224b
SHA512 e5dae89960dc1385ca3f0352487129892bcdfea224cbc57cdd21b4e0c37f85189c245aed832c9b0c3b800e1e268dad066ea31c5b4a9a4ce07f1a5f22753fef3f
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UX:cQRQyi36YOcPQLvw2gAf+PN3NQWdO
TLSH
T16E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d17cfae5a483580711e0f5d95f46311d3d436f2e027458f81dfb6ca09c35f88e
MD5 1fb227051e33f04d4fa7c8e8e145432e
SHA1 c90e5c067dad0917cddf912cfa944616752984aa
SHA512 59cdc1dcb0ea286cd4f57d14f747cf96d350c65edf8e716fc146a23e5c253a76db8d44132c6a5a31d0372fdc324000eff8d67dcd043be986fae6a3e9cd44a2c7
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0usRjhm0Ijr/eaxH:p68Qg55nhheWu7PNU3/fEjhMjSax84
TLSH
T173B55933B2F20099D44DE1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aee6a787162504eb0fac278f9f3b202fd75861fcd6c1b3ded96248ed45ecbbc6
MD5 47cae8295b3ba919b480d723309e82b1
SHA1 72b5a1c8961118dfcd2b478cbcdad795a0ec340e
SHA512 25f5ca4d31012026ccc8c87bff14d1f12eaf11c082b1ca66863fa58314ce65191bd5f3c3e62543dde524001dda18e432bd63f3d57ad8f9a447647fe5c1b058ce
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk991:Cy5112gYy5azzVvL69nLKnhZaQWdO
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 828bbc0bedd9c311e0ebeb485cc77bb9221996e30b5c1a029457f8483f31592d
MD5 c5412b6d47191115ae8fd8de8ad07535
SHA1 339050072611b6d031ce57e3af1545c919401f2d
SHA512 2c6ad76d317d1b5549e6f0d2e524002099f949e0ca2597320e2e99853b290634c3b2e43c4b71d0de39c240b1fe0f47e87bf2dfb4543527c1a5eb609eef75d985
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFEjhMjSax84:gu6JmVxd2dFQWdO
TLSH
T1A7D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 09afadefe411dd59b15a02b3ab7a978bbf35a1c6eaa2f4fc93e9b355b3ab3e99
MD5 5dc0e3f0429b5523bf1d9cd5ce4cccd6
SHA1 3f7c3b7ee5e758509ec589b52fbc396bfe04ec2f
SHA512 3790a1d8f81f7c0c52448c38d84f6aafe5c01dd3a9bb4978b0a8abfca9681f8f29a968ab42b4feee5b8b858ceb49e17646c03290c312f0281e932a795d1f3c7c
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xREjhMjSax84:wmifPbRYQWdO
TLSH
T10EB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2436428f67b6dac2f28a3865a1e662e2cb05b5bd0c6a7e0f932989a5a0712053
MD5 2cf29731cb53c80f8acf3295f1d13b6c
SHA1 4917e71d011a4a734cba42a2928b60d046b90d1f
SHA512 aebc3573043d13132d9581ed00250463bfffb714edfcdfa3170cef91f20a99c1f642aee701923517855e35a97ad95a8d8eff1baf4b43f9233e40e9c8b5a6ebaf
SSDEEP 49152:6SuZQIY0Be2KRRVtOnks6NMHqeEjhMjSax84:k5dKTi61eQWdO
TLSH
T139C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cff23b4b52a08671885c1aac962350ef27ca09739cda9093733094be83174164
MD5 04fb3a233e7b66967c4589d8f13341f6
SHA1 7386864e10287e7f9b2b2cbdfa1aa9d29c4c344c
SHA512 0a24f418ef2b99286d2d318d988c7d3efbbd68989bd2bcab3e15ef045b02af6c34ba21c1210b8742e6b13ad4e07025c8d430d4870555a4222551fc7065f8908b
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5w1EjhMjSax84:HX2iyphUQWdO
TLSH
T12495BE13F2D901E8D05ED1B8C7468632E962BC160B34BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b43a7c760fe608d4c9016e6faf83d08282a033ababf3ffeda189b32f5d941888
MD5 8f36daf5eb2820b8c088a95625989060
SHA1 5dbcc6649617b6c714816a72d340a738191ba2b2
SHA512 1f36656ce14044c667d3ae51e89cbb20debdb5c00b6579ca88d3ba1c14ad6cf24a6a3721bfe7ea8935d990c35c125b79912781b837d24a566ec103fe4e026fae
SSDEEP 12288:3HwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+E:3ysRjhm0Ijr/eax8JXO02q3A
TLSH
T14665235482E52286FB07C9F08D9B1408D499EE9E491178B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 231c6e1d50c384e8e9b321abdfc9666b8754f3a2f2e0561cd67147dd06445f87
MD5 e00004c612fee2bd4eb9e85375f802de
SHA1 d5666d776e6fe0ccca3f2981869b8b67773c415e
SHA512 d8c9999a254f899c4f2ed77ec594944d943fe7ef16db8030cdab4c9f1a9172480e001d786e05b4dd503b07d4803c907321330bbd6eafa4849104b72198603dc8
SSDEEP 12288:FawYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+M:FzsRjhm0Ijr/eax8JXO02q3A
TLSH
T1F865231482E52286FB07C9F08D9B1408D459EEAE491079B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2bd3fd0c72e7070e44b0561bd6f18d6a26dbf06455dee4226f4ca7a15c64a795
MD5 7c92cb6b53873745ceda4751353a6d13
SHA1 bdf5ff7c89c430d1eabc2b454b931a0dd4380905
SHA512 90fea405693e7913c21488d72123fddc216093abe7c9df9a5ee94847f1b6e879cfdf23393cf794151f9521a8cda4f450fa6d548f501074896d563284c6c05477
SSDEEP 12288:wEwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+G:wpsRjhm0Ijr/eax8JXO02q3A
TLSH
T19A65235482E52286FB07C9F08D9B1408D499EE9E491178B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 826e8969323f0736a5db3ea2f6d2889d24dae93c6fe95cb52bdf42613a774e9a
MD5 b77025581f76b4c2bc14c4cd119e79e9
SHA1 17727baba09abd5dc16982b37c91a662414219ee
SHA512 6873b104c507a513287e89f7422b060b473afc3e868a05655258d83ba2e83a1be566f6ba3d9888355a7378b481ce1ca561a7559ddc71001accbfc2cb0c105453
SSDEEP 12288:8VpwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+1:1sRjhm0Ijr/eax8JXO02q3A
TLSH
T18665231553E812C2FE07D5F0CDA70004D1B9FDAA46216AFF67127C1A1DB86EE1A3EE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 5bcf6d13d191a2ab202b9596e909d7720d24db98f335741470745ad800d0b107
MD5 74875efad0603423d7939650e50761f2
SHA1 aeae04df52a7bb25e92d10839f730005dcb75a03
SHA512 6722307515dad1ec2b469c532dd7fe1d1353f63197e34c47ce6f616ca88044692ff38d8f6ab55e0d94aa4f1bdc5417cb6a0a973af624afe16647bbfccd0bbe51
SSDEEP 12288:2RwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+2:2gsRjhm0Ijr/eax8JXO02q3A
TLSH
T16365235482E52286FB07C9F08D9B1408D499EE9E491078B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 18b59c04e7a4bc5ae2fbe10c5875e0ec346af50ca08328176f427a98ffcd2fc6
MD5 8896e3071527797c177f3d86d4b8af0e
SHA1 bfa7943d3114b316444e5c2b979840097afcacd3
SHA512 0fe33de73ac911472d31eb69b45a5340c44a7de1b8d944ec8e77c7436fe7d782a3a0150e582efe64c710066e9fd7827279c51c0493025cc6a7da25e334ec4f52
SSDEEP 12288:guwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+o:gHsRjhm0Ijr/eax8JXO02q3A
TLSH
T14965231482E52286FB07D9F08D9B1408D459EEAE491079B77723BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 c3230a6265016e811dad915f5abd0a31b7b8c93ae8f987af92dd04d001ccb08a
MD5 218807c0cc0c8af5ef88013b3addd756
SHA1 da58892ebf805d71da85f38db1b7f52d7fb66a4f
SHA512 356a66bb38d7ae3ce4ba179d8814c9da6c3db7f1ce65dbdbb27dcf5d90150c45357c3a8ed34557849b4b54f74135144deae22c36720d9d2cd6156ae5998aa4e0
SSDEEP 12288:iiwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+U:i7sRjhm0Ijr/eax8JXO02q3A
TLSH
T19165231482E52286FB07C9F08D9B1408D459EEAE481079B77726BC2A2DBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 3260ddc352ceacbd260192fce711f9f75cd48d4b533d147d81a5a6f30a6a8825
MD5 08f7539f1fb4aaf9dd85518f1f5b89b1
SHA1 97fd65f7fddbd3e52552754bb3d4baa9d3b2ae86
SHA512 9dccd99ca2bc12df16c9930ec3e533fae155a893567281a55b7c904397a1f2ad4267ca6dd76283f7624029c02b2dcba454a0063581f85d39556a0b6c4e2fe200
SSDEEP 24576:QZMSzFVSOTsRjhm0Ijr/eax8JXO02q3A:QZMSzf3EjhMjSax84
TLSH
T152850194B3A018F4ED67817ECD564905D2B2BC5A0B60CA1F13B43A2B1F773A11D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 1ed2b281687a41a11baac853fd2d04ddfe92c19d12cffbc9371cabaaf3b70caa
MD5 41f9187f891ddead733a81ef5f9fd73c
SHA1 79742b4034ba6390310972ae41c0399e8d3965da
SHA512 b3f3ae3b687ead411a466b0a71d96c3e1a63e9667b0f4218a9fadb0db5fbb3f539067e9d71a884f8df1e91413867a88329708ee015843110d8b6555df637f23c
SSDEEP 12288:9jwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+w:9OsRjhm0Ijr/eax8JXO02q3A
TLSH
T1EF65235482E52286FB07C9F08D9B1408C499EE9E481179B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 41230bd97f2489bd743c8f6a751419f99fd01e5a16109645ab90fbecd6e8e804
MD5 11b62d48ba4bac299a404f72d8bff9ab
SHA1 9dbaa0b4a6c8d18b808b6f5b7debf06f9984cb02
SHA512 029871360283cf2c8c97d8f16f8d3dd3ec0fda00f57cc1fc8e054c41649ebd668b3b74ff6e6c2788cf037741df9f843e900202bb0f3a5881367e0b430fec3ed3
SSDEEP 12288:l/wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+O:lKsRjhm0Ijr/eax8JXO02q3A
TLSH
T18A65235582E42286FB07C9F08D9B1408C459EEAE481179B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 ec7ee1b476466232eef68bdaf376ea66a90b78cbf027e9aa9df64bf36304121d
MD5 142f6619389a509450e1e5c42b2cd3c7
SHA1 9640e338c4b55f0ca93870a6999afdad0a475cba
SHA512 d09095181c37459b1a558fef50765413b5ca26580b80591c691b465902041b443b580ee747d0417a8457406e4809bac25e7ab785c1cccbdb199d6bc45f5bcf82
SSDEEP 12288:eyPz5L8GwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:Dzy/sRjhm0Ijr/eax8JXO02q3A
TLSH
T1BD75020763A131F9E52782B4C8931905F376BC3607209EAF13605A7A2E376E55E3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0c50fc66d855cbad4baaf2dfb11fa32562fe3c7985d40802cd2cd774d4ba0163
MD5 df238d91e91991874ce4f7953829bc85
SHA1 bc88547db38adaa8a8fff7ad8fa4ce6116d08e57
SHA512 aa60150f47977e7e4eb759388dab94c4e8a229cbe247d3a24fdd4b40bd4b9edfcaec19fafaa3f6691780e2f9d8c823d4626a4a750be6dc0bc418e10a6fdb7846
SSDEEP 12288:0jwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+V:0OsRjhm0Ijr/eax8JXO02q3A
TLSH
T17565235482E52286FB07C9F08D9B1408C499EE9E481179B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 043e075967655837520e5223ece579287a34731b0661f73a3a6aa839f1115e7a
MD5 71de8ebb011e4492bebda837b4cf860e
SHA1 0f1053955db5867b0a66deac89943bec8e17ca17
SHA512 b19e356bfe132b3e8966b1cb899c116db7eb569386727466e611ed0a2a39099cb995025ba2693539a7853e4db9f35b85f31a9602b312d5bef9145f237a6313af
SSDEEP 12288:yjwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+F:yOsRjhm0Ijr/eax8JXO02q3A
TLSH
T12665235492E52286FB07C9F08D8B1408C459EE9E481179B77727BC2A2CBC4FF165FC96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 21c8fd0094b1ce60ceafa0aabf43642786a0b6aeba412157777e1e807a16a098
MD5 4ece4fe92069340556d32cde731cb222
SHA1 527476b4a48a886d886aeac5718aae911238f6b0
SHA512 43aff8a85a0220804cfef20670585d1421613a460dbb5cfe320a1e6686e78cde5b8ccb75df7afefd1634046771b7e472b66b94830e0addb482067a2d8bd49191
SSDEEP 12288:syPz5L8GwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+l:1zy/sRjhm0Ijr/eax8JXO02q3A
TLSH
T18D75020763A131F9E52782B4C8931905F376BC3607209EAF13605A7A2E376E55E3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7a4976dc4794b99cb0c681bf7c2c7d64d1519853296dc12ca61699b9250642c9
MD5 7fe27665678f7fc60e0b1932946a2924
SHA1 0abe9192727ac1d784bc94574192649097f24ab3
SHA512 a705390400a60976afb0e3f686a4be614ecb793e259195902523f7baa0916e4150a08f844948880cc2474ba21a260eac61bb94057a482ee1a900730384074516
SSDEEP 24576:+cP4mcvIjkGOxhKP2l71SNKbrh/8KB2sRjhm0Ijr/eax8JXO02q3A:5P4m4IpOO67N8KMEjhMjSax84
TLSH
T19165AE2DABDC0096D0BB917485668A49FAB1742A1F3286CB1160A33D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 afc9cbed4a3f8a5769fa1e5ef5eaf37c36ae0eb395d6c1b5cf8902454e369dd7
MD5 725fbe9c38c810ff584faa24f63dd9a8
SHA1 59204225c84eb260aef3f4dd6556f27bc460c313
SHA512 24d7912592f9a5bbb811427b738407e2b155fa9ae8539b242e41996b222fe144d6ebdd76b05c35f97a6e0659e64b2815448592b4b783adb8f8a4d501ef71d6de
SSDEEP 12288:BNsfTwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+x:GesRjhm0Ijr/eax8JXO02q3A
TLSH
T1F675F119C29812D8D11EA1B4CB560A00F327BC6587E1E3CB63D0F93E1F796D55EEAA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 65b6430d1c555c0dcfa7a227d4515b4ee2ee7b4565fcc4be1e978083a4770bbf
MD5 e2466292ba4720be13a15256a2da948e
SHA1 387dae3c76e3ee5c14a1de6ffd7cdb1006c6a19e
SHA512 03187abff3c384c6622fa7e579b177f691f4125f21d2d52bb51d31af38d2bf360f76a55f22e1946146f89efda2a13b633f67720de692124225ede6438477cde1
SSDEEP 12288:hzwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+P:h+sRjhm0Ijr/eax8JXO02q3A
TLSH
T1F9652315C3E86647FB17D9F0485B0418D01EFE694E10A8A7B612BD2A2C7C8FB5E2F907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ec56f20608a4e2429e331da058554cca2275ae9d9ef6a0c2b83399738fe98d7b
MD5 4c96375223db600588f951bf2d0f7879
SHA1 73eba2109416abe0969bca722500461c9dd7d417
SHA512 770b6552b67d015ae891aae578beecb9152415c22581ac23431aefb6c351eb6e2f272ca7676e8feaaac2d9e73454df1808926d7d97553c8124370adc33461b97
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQgEjhMjSax84:La0hNYG4JwXQWdO
TLSH
T11585AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ba86727333946abdb0966d62de239a676a54e9b6c1d49ed845bd04eda3a300f1
MD5 9eba256992302c1d1eead4cb2f70ff05
SHA1 ac883fd0d0553a375aef5d00a8e76b5584b25646
SHA512 37a858daaa7f1e95ff5e10e41023a4b36c244c39f39c97b5a28745632396258e4eade8e2a0d678abcb767130966130ad2d7dca0d0a29341e393794478064828f
SSDEEP 12288:MhbHjfXKwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+Q:MhbHjPDsRjhm0Ijr/eax8JXO02q3A
TLSH
T1D275027D12AC21C5F632E1B889964509D371FC250711A7EF2392927E1F3B9E91D3AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3695d6c861c905313f752af3b62472fc3a06ba94c52c5399ab1778340b9f1562
MD5 61c409ff115ee8fa18a1ebfca4a8bd43
SHA1 9b868d9704ce689e604dd64ac3fba656ba5d2ee7
SHA512 e39ffc90aa9841a11583479a4e130bf9cd88d50201423b4fcd53b0f3ce2dbda17035a2e300a40f32ed591e2f177f2cbd53742fc523778847b770c36a49616710
SSDEEP 24576:b3YgnJcRTk4yti+R5dpR/rsRjhm0Ijr/eax8JXO02q3A:bIgnaTk46ppR/rEjhMjSax84
TLSH
T16D45BF2DF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2f18aba69daa6f41aff4be45a01cb059b5b666960b7f80ab94b09e267b001747
MD5 f02699151fba99e56bc976014191d737
SHA1 9f680a138b70278390a478f8f767b8e2cfca1daa
SHA512 7d23d7fc478f7d2d3ef63c94953f0a3e4145c9123ccb5318013c2f19facd2addd41ed6c21ed0ce456c696c422816a3437d611dbd2ee5b300303a50149af4a4c3
SSDEEP 12288:FPwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+H:F6sRjhm0Ijr/eax8JXO02q3A
TLSH
T1EA65235483A42686FB07D9F08D9B0408D059FF590B1179F77622BD2A2DBC4FF163E982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 fac4cd0a97b4d0d6e5d05f17d7bd3514bd0fb7e053966c40e969bb7a4c1b405b
MD5 7807bd950f8bdf8153af08614a54e8fa
SHA1 d92c88035fc12d292ae666872607548e346dbafd
SHA512 c2db683f8a6d28d3debc13996cd02524ded80d58dd6979c08ddc7a49e2a130418cd023a1330cf90e5e8650efff8f6fd2645aca0eb9fb742f384ef491f05c86ae
SSDEEP 12288:2Ob9A4LWOsvAYFTgwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj++:fpL3UT1sRjhm0Ijr/eax8JXO02q3A
TLSH
T185950114E7E400F9ED6BC17CC9A78916D272B85D0720E7EF03684A661E637E64E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d2687e362b6bc7635c578076480a79e8580a3da61352544a6a57201c432f5c8d
MD5 615e05dc29aa5629c5d705dc9d6844f2
SHA1 dd8740bdde7faf6577611a2b67f9f6dc4a806dcd
SHA512 0107e72f5f8c3870e2f5f7a3d15e6ca3fc2d26970e2639b7c785506ef287009da5782dda20943c82753b5e1ddd9e10f5fc8b603046e06c0b5dd2ed2e447a10ed
SSDEEP 12288:5pFtpOswYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+C:5ORsRjhm0Ijr/eax8JXO02q3A
TLSH
T13775021933EC20E5E526E5BC8997420CD371BC66072167EF02A0957E1FA7EF86C3EA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8d1b8692b8daed985b51e9f0507b3c664ec8875c48286640fa7a8153479870b2
MD5 bc019e83143bfb0f6729857184d34152
SHA1 7a4252a61fb35c94d831ab5c63b516ceaeeec24b
SHA512 e9d8826b9ec79a92eb7cbb9e1d5f5f1207df67dd206091c507dd0cdc00425c600b4c124334e6476d76f9a6a59b5b269cf084ab36a8c5e19ea004526058ecc6ed
SSDEEP 24576:x7NM9YmZqmWMUkPjZM48Mv6bEhsOsRjhm0Ijr/eax8JXO02q3A:x7cBWMpPjN8DbEhjEjhMjSax84
TLSH
T1E565AE2E6BEC81D5D577D13DC9A28205F6B1B4611B318ACB1162833E6F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b983251f1249efe72864442ea35937ab67f707b018e467ef311bcc6432193e62
MD5 5c31f5551d4dca79f18074df7affae18
SHA1 ed0ab8b0cd1520feb802d5d5ab481655a56e872f
SHA512 399f5d5d9d89e082508bc6f20ff8073a532071a0869ff993ce96d1e6ebb18b8004f77cd8b966d49b97708cf9460a783eb4117e95574c90f70c6d576f1c6027d8
SSDEEP 24576:PW6BApg2YuyuNDYTabvcRvNYf8km1ksRjhm0Ijr/eax8JXO02q3A:PF2YuHNETovcvNYf8kmuEjhMjSax84
TLSH
T131858E2927ED80A4E0BBD2BD45B79246FAB2B8551B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 69950cb34cee8a57eed8b2bd7706213f9d7544871bf02b56f81c0ba0fc392072
MD5 5bccbba67148afe1df724c920ea7a049
SHA1 0cff72207fd609b96dd64ce20c6dca5fa8d8ac25
SHA512 0b17db6dd4abdcf7827d5e43bb9e9130b9b6b8e833942606d296909b6e805e15dc66cb1a818ea72151a16db0df645a2f9f33cf17399ea2a30b75df1fe28e0a16
SSDEEP 24576:6AFs06+Omlf3NXEbTotsRjhm0Ijr/eax8JXO02q3A:DFs060lVXuAEjhMjSax84
TLSH
T16D65AF2F62EC00D5E07ED17D8997C91AF6B1746707215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 0a40d63e92ebb469e6595d4ca79317d98a08f803efdcbcf03e9508cf51023db5
MD5 32baab8b5ea96c5ea875741d7a2c56b8
SHA1 b1f37180b6156186d565ca13fbc54437d7b2f115
SHA512 d73fafb1ca654bbb2f57b924be09f682752d7a25fa64a9f271651110f9591bdef7100d84415b1611fac4eec725b0142c603cc3e09182e351d0c0536100819c34
SSDEEP 24576:dJnJ5D3WtAsRjhm0Ijr/eax8JXO02q3A:dJnJ5DGtAEjhMjSax84
TLSH
T1AE85D02DD2A810E8E4B7C2B4819A1755FE72387D2F226AC72874D5353F12EE09A7DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 48a224adf6345023b2bca3afea39b628e7a65d7b423d67ea71a415d997113d35
MD5 c0d1e0a194072a555ac08279e72b1e0d
SHA1 dbe74c480a34413389db1dddd922766b4af28e4c
SHA512 59c1c51164d257ced08f71378340064522d5454296d99961cddf2e9c753478a9d43925b4599709e61eeaee397577c8ac197c2dc744c2c074cd4703afe1e96528
SSDEEP 24576:qEPohm6/7IIXdwcXrif7qQncjlP65i3VursRjhm0Ijr/eax8JXO02q3A:9o06DIKdwc+eQnSt65aVyEjhMjSax84
TLSH
T1CE955C16B7EA5294E8B3CAF1C962A1159B327C509B34F7DF0AC0C92E1D33AD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 837fc13eadb97785a8a29f91a93ccaaf532303938c9bcd886146dc2c7ea21dad
MD5 ee039e0bb058ac602d3f5359785ef0fc
SHA1 54e67eb507f739149b53f7a1180f31a9aab8e7aa
SHA512 2bcdc511f59d008993e3735433cdde6596504a5eff51375ff614a1bc471f6a314ad5416420a36a6573d8a629cbc3684bde1e0aa9f3dcaedf80b74c6dc193d5a0
SSDEEP 12288:7EP3Rr9wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+f:Ar8sRjhm0Ijr/eax8JXO02q3A
TLSH
T14475126D63AC70D5E626D0B889924504D3B2F4750B122BFF12A1D63E4E7B9EA1E3DE01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 6814deddc2789327f8d35b23fe238c6b78649b3e4f5129e0c8f0093bba000136
MD5 25c60440b95e9e4e59438145082025eb
SHA1 da5d62a8a694aef9283bf145b216531e5d70ab59
SHA512 ef3a6cc329d536b6c3cf29c36a4aa262dbee4c71a5d563939419f45bf20b2afdc32b8cb12f46b6fe92428783ead5c4c00dab77c3db18ab33206f066f62235985
SSDEEP 12288:CjkyawYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+2:CIyzsRjhm0Ijr/eax8JXO02q3A
TLSH
T19975120453E861C5FA6685B8CDA30154CA75FC304F2066EF6150FA3F2E7AAE96D39F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 a070384df2ae6a61def61988673a4bd707972640d779caa41fbc9852a18dce2d
MD5 bd4f335e63cdebb06160402abae3d30c
SHA1 d2335a3bf2e283f6bcd6d1dd7348fb8eebd0b492
SHA512 a4f4e635748e6da6ea0d52a72d761b37fe193361297b447d1e0086ab7a70a175a10bd21606244a83185160807015350b0813e1484a1478e842bf77d436556d31
SSDEEP 12288:8F8wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+9:KBsRjhm0Ijr/eax8JXO02q3A
TLSH
T14765231842A53286FE07C9F0895B1904D069FE790B1079FB2662FD3A5DBC4EB167ED82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9e39c28d94980b2765693fd8daa1bc3d0c2390eefb4f6258cec6c99e8a9888f8
MD5 7631d944d963b3b30efd3d01bd0b2f80
SHA1 f6049627978b3f57a8ca1a4c3e67f29c1b3e8cd5
SHA512 f880616aa99f4ce45ac9a35a74158f4b9de9123a3874f0cb3167175f083ea0a0d7cc1bd82a617f486f9ee1be457ae060f0af8efba4bcf79674503a0476c711d2
SSDEEP 24576:kQ9MxZKdcz97w3GsRjhm0Ijr/eax8JXO02q3A:kVKXGEjhMjSax84
TLSH
T1B1558C2DABE9058AE177D275D4A250C3A673B4311B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 2d16ee2cbf9881c4bde900e1b6c89a0fe4413a618c12016f005d2222356efd6b
MD5 b7e8ceec4418fb01a32867f1186c8819
SHA1 45d4ab5e5f391212472d4efbcb9a7ee0e0cbfe8e
SHA512 a8e0aae34d5d118c7eee6c555f141ddd009fce2527e44eb78a5f76ff351925c136b359c87a272a25af41a5af5761881a4466d9f2c332b098d9439a8a2d5aed96
SSDEEP 12288:gyoKo2HRple9p2wYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+c:gyocxApPsRjhm0Ijr/eax8JXO02q3A
TLSH
T16585E01FB7AD40E2E126C13C89868604E773B4301B2267DB6691C73D4E679EDBD39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 48c11eb0d71548a20cc87ff2ae5968f64fecb9d045165b81df4459b4862c80ca
MD5 26ab99a7a75bae8c3939c6fc2411170d
SHA1 a019709590ef4169b0fdbf6ce0fb164e59492b5b
SHA512 02ffdaa1dd5963b5ef51b75f4f25bf6edfab15162647cbb916c78c29a28531f889c6ba2a156050b00d518d84f3f72aa417c9152425e4621fd8e28d2f5eb3c24a
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKPEjhMjSax84:/0zuNIbQWdO
TLSH
T110A57B3DA2F800A8D9AAC375C5461365EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ff04b2de5d48c75d3ef3c74a0c4afefc90682b5bd3764c60c5fa98fb6f843294
MD5 94a8c8271e1b6ac30407fa664c8fe84f
SHA1 90e6a52bc604df5662a5e30197b46eeefa088969
SHA512 0ca9837925670a5e64b3a6809d7ae0d7e3fb0b556ab70ce316e928539939944a5568cebb996822abc8ee793862b603b62b31b1cea0748ac5eabc12265b7f6e7e
SSDEEP 24576:81QT7EcpfxR+N5AWAz3ooiYtjMqb8sRjhm0Ijr/eax8JXO02q3A:hTDxR+N5YzTfjMxEjhMjSax84
TLSH
T12E55B12EA7F815E9D17EC5789A238512FA727821033193CF42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 675e823795c7e56b9bcbce45554ab0fceb87f41e89c65a31b28b43f66adee5bf
MD5 a1dff23f8bad1b88d9786ee79dacd2d8
SHA1 77e269b0ef234e14b1c8979d190a30298b3f4782
SHA512 b654c19dce4c776022ef87ffe490faa32023f08f8bff51c29d2366695e9e9a37e20e51b880c2682c13e0644dd5206cdc2a7cb21dbd1986ed62a6ee6fb90783f6
SSDEEP 24576:+TMdOz0FFS+imSLYsRjhm0Ijr/eax8JXO02q3A:K0K+imSLYEjhMjSax84
TLSH
T1F985E13EA3AD14E5E57BC1BCDA438906E572786603216ADB0690C1793F5BEE4393EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 3862b7329e03989046020d2360110cc6be95859cd1c7d13defc7f94cf0375bd6
MD5 b0c610b2b617f03989751622e785cb97
SHA1 00237a32971903773ded68b60a2a5226e2364b93
SHA512 1ea0e74f90eb508ffdd0f27cdc30a87b8c79e39c87ab1e6d47fa1a431e1691f2748658c3eee1014c53604d2508e992086ce1458ed7163015bbe10164a1ef7f92
SSDEEP 12288:047gwYeskMjFvm0qKWjr/pMoVx8JX8it802q3LZj+u:T1sRjhm0Ijr/eax8JXO02q3A
TLSH
T11975121C53E830C5F922D6B48A670104C171FC7A07206AFF35A1E97E5F7A9E9993EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1544-125-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1544-299-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1544-131-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1736-474-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-459-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-469-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-471-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-467-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-466-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-465-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-463-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-472-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-464-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-462-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-478-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-461-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-460-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-473-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-468-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-470-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1736-479-0x00000246202F0000-0x0000024620300000-memory.dmp

Download

memory/1816-298-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1824-48-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1824-47-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1824-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1824-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1824-39-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2112-193-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2112-187-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2112-198-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2112-196-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2228-84-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2228-80-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2228-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2228-86-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2320-88-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2320-94-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2320-294-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/2652-314-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/2652-20-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/2652-21-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2652-12-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2824-220-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/2824-226-0x0000000000B00000-0x0000000000B60000-memory.dmp

Download

memory/2824-309-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3284-0-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/3284-8-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3284-1-0x00000000023C0000-0x0000000002427000-memory.dmp

Download

memory/3284-293-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/3336-116-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3336-297-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/3336-110-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3344-183-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3344-305-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/3344-177-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3380-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3380-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3380-455-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3380-96-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3528-59-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3528-53-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3528-61-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3528-454-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3556-476-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/3556-310-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/3556-230-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3556-236-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/3816-273-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3816-477-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3816-475-0x000000000D250000-0x000000000D694000-memory.dmp

Download

memory/3816-247-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3816-257-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3816-452-0x000000000D140000-0x000000000D148000-memory.dmp

Download

memory/3816-289-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3816-312-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4172-100-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4172-106-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4172-313-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4288-156-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4288-162-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4288-303-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4372-135-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4372-457-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4372-141-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4372-300-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4372-458-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4420-26-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4420-34-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/4420-35-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4420-402-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/4524-216-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4524-308-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4668-173-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4668-167-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4668-304-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/4916-302-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4916-152-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5100-206-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/5100-306-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5100-200-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download