Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/07/2026, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
- Size 1.6MB
- Sample260704-2sc8faey2x
- SHA256 c39d2c5493b9a51f40b51050e1bbc8d9af0b60e88e6c4442d62a7f6bd234cc8c
- MD5 8448c3ee586a07db06be1f10ddca7c5e
- SHA1 30e522dfbf07d22cebeb6a24c53a1b528ac7bad6
- SHA512 0c8ba41144262607b6ee657c1ed0620badc45cbf3217d9852b3f659ad9108d3ca0150bbb20b5f2a779ded01941c94c2ae8075fccd07065ee756f76d8be9c015c
- SSDEEP 12288:Rq9PGxTszBAGubvoXmH3pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3WN:85GtI/45sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DA75016172C080B7D973093046B4EA71683EFE315F2449DB73952B6EAE706D18E38B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5264 alg.exe 4688 DiagnosticsHub.StandardCollector.Service.exe 5800 fxssvc.exe 3396 elevation_service.exe 4716 elevation_service.exe 5084 maintenanceservice.exe 4496 msdtc.exe 2312 OSE.EXE 3096 PerceptionSimulationService.exe 4748 perfhost.exe 4420 locator.exe 3040 SensorDataService.exe 1212 snmptrap.exe 5788 spectrum.exe 2580 ssh-agent.exe 216 TieringEngineService.exe 6088 AgentService.exe 4200 vds.exe 1808 vssvc.exe 4532 wbengine.exe 4616 WmiApSrv.exe 2796 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8b330f7c2d44b5a9.bin alg.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe alg.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4d5a68a070cdd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4fbcc8a070cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a9e4e8a070cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002bddb18b070cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046b5238a070cdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036ba4d8b070cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ab3428a070cdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeAuditPrivilege 5800 fxssvc.exe Token: SeRestorePrivilege 216 TieringEngineService.exe Token: SeManageVolumePrivilege 216 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 6088 AgentService.exe Token: SeBackupPrivilege 1808 vssvc.exe Token: SeRestorePrivilege 1808 vssvc.exe Token: SeAuditPrivilege 1808 vssvc.exe Token: SeBackupPrivilege 4532 wbengine.exe Token: SeRestorePrivilege 4532 wbengine.exe Token: SeSecurityPrivilege 4532 wbengine.exe Token: 33 2796 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2796 SearchIndexer.exe Token: SeDebugPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 2252 2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe Token: SeDebugPrivilege 5264 alg.exe Token: SeDebugPrivilege 5264 alg.exe Token: SeDebugPrivilege 5264 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2796 wrote to memory of 724 2796 SearchIndexer.exe 117 PID 2796 wrote to memory of 5660 2796 SearchIndexer.exe 118 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_8448c3ee586a07db06be1f10ddca7c5e_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5264
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:4688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:6040
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5800
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3396
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4716
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5084
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4496
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2312
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3096
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4748
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:4420
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3040
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1212
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5788
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:1620
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:216
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6088
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4200
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4616
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:724
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:5660
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 7afd26d040cf3c1cb510f53de8f7c50db2c658dfd577777cb0c1ad6e82d7dcd7
- MD5 f9588a266bd09228160bb9bff2ab6db5
- SHA1 160761d69cb76bc61f79c2c3bc94f43ddf9d354f
- SHA512 e1d751c41aafa8fe8647e5a7f789a2d04709312e8c5ff9035ec6139e50d6af3634cf41194a82faaf5dd0323fb96708dc6531774d62ad498da16e9a5cb51f440c
- SSDEEP 49152:Sb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEDmg27RnWGj:03q6mjBHD527BWG
- TLSH T178D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 1d99f1a5b7070ee652e766a7aa34d5a04accf4500dd85bd32d4f58dc11319410
- MD5 21425584886c47d86d296a38c739b88a
- SHA1 ac077157aa7a5f39cb055281f01ebb73f7976ecd
- SHA512 b30d49a33a2131abfb7ecfb780277bfc990303105650a488358de7a795dd24a61c8e9f223090453d4574e30ec3fc0b6c8daa9697a5964732d95d8ce3a6b67c2f
- SSDEEP 24576:2XYfDtczAvsqjnhMgeiCl7G0nehbGZpbD:1tc6Dmg27RnWGj
- TLSH T112850129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 c7ce4048e84784387bfbd0ad44ee776d6de39c88a6eda68df3f767bca34b37f9
- MD5 8381727ef0b261559ecf172fb9c6b388
- SHA1 ab844e7f82000c76b5677942b232875a36cea638
- SHA512 260074969be2964e6e6aac1bdd649a03e5dc3ae42364d47c9b44b2538b36c765f6e62536d743d7a09416d97f8ae5ef8ce7a024709a7f43b6f8e26b15de307ac0
- SSDEEP 24576:w0Le5ji0hmxUrMwsqjnhMgeiCl7G0nehbGZpbD:wPji0A2VDmg27RnWGj
- TLSH T1C8A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 3079f7b4e61ce35cee8e44e305ca3b9520ea3988c6fdd09aa4f509ee7ece36e0
- MD5 08aa5e3657972a3cff28430ae8540848
- SHA1 6f17cde9df1cd34d3ec40d3bcf3dd47072f24e7d
- SHA512 c76c7ddc2c5611736ccb42e360ac9046cede2eea71e18ba997e5ff3d5987544b1a79986ef5dda980ea829d2290a7c0f0ed07208cf60ca3d42b7e0da59916024f
- SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyumsqjnhMgeiCl7G0nehbGZpbD:h/ezSC6vUzPv+HjyxDmg27RnWGj
- TLSH T1C5755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 a6483f53331825706fd42889bc9427b103e32a164859df09f4517e9637c109f1
- MD5 e67470b55782247cbbee190049565934
- SHA1 b2d877c62dd45a330204ab4d1301b231d2b92032
- SHA512 2111cbe374676c82f36e5ed7d3d9ba1a89965537e335b3c31a541ac50d2ce7c24b1774392de65a69599d9db62a30eebe42875d4d9a30a5be9f19dfb7e1c67f6b
- SSDEEP 24576:MVbqPb88hv/l+BzsqjnhMgeiCl7G0nehbGZpbD:MVO88hXl+1Dmg27RnWGj
- TLSH T1EE559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.5MB
- SHA256 3f8373e294f318262e3c0d8116cacffd1858405080fa7f7130acce2ac28dfb54
- MD5 6b5f5e4387fcee984e703adc7efc9bfa
- SHA1 5d55da4b8e6eac6b72390bf998e3a832853c1d43
- SHA512 4968771166fb62e8ce3a8a3147daad909ad8b77c6577e9acbe9cc23494102269a69c4d45874bbdbaa8503d4e6ac07e21bb11a76b6c400f286847c0c47ec1e559
- SSDEEP 12288:1kUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1kUsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1316523BE825C10CAEA7608B5C3E9F51EBC173D56982018436AA37DFEE9B5454CB3D423
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 dd1c7b98aa2938269a21bc91cfe87720627c8d3a99cc93e72dbde8c600b7d741
- MD5 0e4e02746dba99297fa3f7888a812fac
- SHA1 f74569704e5df387e8eda1151113a1a9021b2be2
- SHA512 b445e56f81ab21892312223290c83ffb543d1e71f00b87cda012e8a16c457b31a2ad2c244b5608d59a7e89df643caf348f8416f89e6e76da65752e72f5f0a6af
- SSDEEP 12288:UeBNUbTVO86ULXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:UJIULsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16085CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d1259100656b21a12766212c9c66550faf493cb567f4e690fb3bf10bdbd89bb0
- MD5 d1c57039c3a01c8a97cae598b55f4336
- SHA1 0a139ba922b6e91b1d325d1cf4e583e70e69408a
- SHA512 169ee49173d334bddb943407560e6157faa5a30b58ba8b0ac248b46ad67df70beb6b1c876d04d9d559cef26e2ac9ba8bd33866d59ed87a998407026c44647832
- SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH2:5QvGAdlCEL8c/WRNw5CaD527BWG
- TLSH T158266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 bce8be36d5dd79396590ae992e128f1f0ed4305c1e8838737d71d61d21a8da02
- MD5 16d7dfc047e44feff381d4cf75bff5e6
- SHA1 2935d03eb588519bf5c47606bba6eba7739e9b54
- SHA512 7039b8ce29fef8d80527a6e651416233837723818556c635d0c5fb5cc94ff8aa7f7e0e9abaf900fa915bbe302ff89d6db05360d4860c768f8e74a7cd916101e7
- SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:4AewsAjxsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AF95E031FA74E036C37B0DB20B76D71A682D79204F6119C3E3E89D9E99702D1277AA17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 22353213be7292d80262b9e0034bcd9cfd8a0ce500a4d00ccac3a046462dcba2
- MD5 924ec1b7080d7123861fd5379cb286ef
- SHA1 820c1ad8a501b66428b6c217fc06484335f57a27
- SHA512 a4a880f17fc9da16e2918799e81eb3457d1fb4445f374bb77fb7c6657fa54acc92465ee72474c08571675af28303561412822ad7034649a88d926f90414b6888
- SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH9VQBWG:GUEtQevvqc2W1cpV20I32IB
- TLSH T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 6578a901c93290768a0f11fdd50fd154979801cdf1f9f95368ede89d6f957995
- MD5 a9553066f2a751ad7ff9d61b252b8bf6
- SHA1 4d81c480ebec350b950193a96263f79fee88ca4e
- SHA512 4ec07b8d8334117d9d6e30c30af6e832740732e584ac07f555eecc23c7effcec43c1add36561046864c136bf1ab8618a563de5f5fecf6fb203625b661e33720d
- SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/zlDmg27RnWGj:MoqHVjnm2D527BWG
- TLSH T101D58D1976B8C1E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 949d8e600ca454f7eaa6a9e4274d082eea0c36a54f8d46f684e7404db5cbb1ff
- MD5 6b5c38248f31c0f26eb4a0705d347147
- SHA1 7b103be15c121b4a2b3deeed9e2eb486a64b88c1
- SHA512 ba07a9d9aeb83015aa5df46d85d55df76098f6dcd6ea808f7b05858bced4a7d2eb8a83c26f7c16621ce242709d0c0ba253a835486f2e8bbc404bcfaba048b0e3
- SSDEEP 24576:lAhGL6IFoiwtA5l7S53SsqjnhMgeiCl7G0nehbGZpbD:lAM5Foiq5mDmg27RnWGj
- TLSH T197359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 23ef504f475e5f5ee975d4285f29c41c0898ac1a21fda4e53610699dfed52b03
- MD5 6a605ed516c80aad2afb1d3dba215e13
- SHA1 6782d9a978aa9b9d5815a2f970174471519076b3
- SHA512 302e4091edc232fafd97455b3ef6ba3250eac12de43144410354159d09d71b9a492172227b55faece67cb6bb494bff2a657ae4d2d8f86465ed4ab2e67b6295af
- SSDEEP 12288:Hmw5HEjsChNWBFgl0WDm+CGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Gwu/OWtsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19785F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33250AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 6b85a09284ddfb4befd880cf893cf60bf07568dcbe32b770551ad3e3d123ea03
- MD5 fc2fde2a343e64ba4714553039f6cee7
- SHA1 fdf83a30d99579a6131054875d7cbbb5a03e2d45
- SHA512 ef342833fb069ce3a93b8b242897d74dc096f7759ab2bd802ac05b05c74ec3f8f5e330e3f5503f9b1f246cd7da1f77cabb126480bffdd943555d3960d585bcc5
- SSDEEP 12288:7YZ1IyhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZuIsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1F47512AA239820FAE1A74178C5E5D609E7333C52673043CF166656BA6F73AC44E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e077306eca02bd3fe4b985c495b5b6d6326155ffdd3b858f1b81f066c0f0b5ec
- MD5 ca38fbf2fe99352377219189231b2082
- SHA1 310ef676afdc3245c3b5930894e297c3df7aa54d
- SHA512 0345bfd5457e1ead667cdc48fea7b15fdd47743d68d58dc195776be2ca8886a4fac0ab85b330aaec9faeca395c70ed3029a6a19ed2bf988a1ecfea52db89655a
- SSDEEP 98304:iQRQyi36YOcPDLvw2gAf+PN3bD527BWG:5QyiKanX+PNrVQBWG
- TLSH T107667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 b56db673157096a3e9ef6827fc050b5ddb8841fbd1e04aab837a5503e2a82473
- MD5 0cb2680d5d7b565dbf21b3e92e81f55e
- SHA1 fd36323351599096cea3829ec531ead6249cf65f
- SHA512 9102d0eee387b26aea16c108e76f6230e65ec49cf49da1fa2604e2308bfcc4b94ab79b616f724e7cdaabb1c492c3db091587327c57f3e862425278fc2ed67fd1
- SSDEEP 98304:1QRQyi36YOcPDLvw2gAf+PN3bD527BWG:MQyiKanX+PNrVQBWG
- TLSH T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 e2806916ca50e38909e7b0266f604cedefe871b57b4c516ead0572e472e670ae
- MD5 b2ec7f27a697aad1b9ecc430689c5f8d
- SHA1 9dae73cc50e2df4154b9a2ba0d0e606cee6516fa
- SHA512 869310887abc45b1dfdae81255fb23f54111c0eebadf6657af6e137365fa1907efb3c5c9d15a5484dd464818d38498c90ed937b22fa82b47f5f00d7161dcb54b
- SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0YsqjnhMgeiCl7Ge:Z68Qg55nhkeWu7PNU3/VDmg27RnWGj
- TLSH T192B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 952acc7ac514fb78ae8be83a3b5cf8c3173cd4271db709c254bf8c446335b499
- MD5 f4c3f1a8266fe943194b5f812baa2711
- SHA1 e570d25b3c7841e4c55a0e337228bcc9de5560a4
- SHA512 bbde533b3489d89e272eff3b80ed3ba6383a73f54b9c6a9fdbd134eec9ace3510a5f3cb611c5c5911b33841e48345c75f7eb8f03e3458db5460ec3dd0352ff8b
- SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZwD527BWG:5LIHRWhOVQBWG
- TLSH T1F0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 043f97d142dcc4ea0b736c40170027a4d97574ad4b0c83dfad6051e5ef40191e
- MD5 fb3e2a6ffdc3f53e46bcffb30674244f
- SHA1 1d3663de4a89bc0c1f567501666e7c37fcd5b9c7
- SHA512 3848d08be91f3cbd9a472ed5bffe2ece1d80a3ac6972f889b89d0e3a0a0e12d8346d2bb0c396c3dbd8f3c9b731f3767dd198fc2f4ffe7db18bc4d98424c6d4d9
- SSDEEP 49152:nB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljDmg27RnWGj:pu6JmIxd2djD527BWG
- TLSH T1BCD59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 f90a0c4b4463f643e8923e3b328e18c06901fa90c38bac8198f63f9f1f3bcfc0
- MD5 fec9f2aceae19235ff28214d60d29d1e
- SHA1 310415afdddec5306f4111797c00475bebd80f67
- SHA512 2995aee273bfa1a80985a5e3ef1b8d2155b1cd61129c28f022c0a93d285a18ca1c074e152c8696b566a1e4d4de0715257c59484be3018fe242b3894ab5c71e7b
- SSDEEP 49152:41hpsNoJpF1A67U44CwH7R4xfDmg27RnWGj:4mifPqR2D527BWG
- TLSH T190B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 aa535619f1b9137e045d32547431cb74f4ff271b2de0d1508401d57bbd9b6b9a
- MD5 9aa1a8464f6b0e8cd2f2c265b4b6a301
- SHA1 c53a30f8746222e06dfac82fc3cdbc16ec8ec9f5
- SHA512 d04f2b95c4cd8628400df88ccbd1e538e2bd09ff79cf27701e2abc294ebc567c32886b4a1939a9d9d199d410c784b3e094f005526d4779e3e120abea67f895f6
- SSDEEP 49152:hSuZQIY0Be2KkRVtOnks6NMHq0Dmg27RnWGj:v5dKqi610D527BWG
- TLSH T1B7C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 ae9183cdc8fd499935bacf1d241ef2c2cb96445394fa906bf71a37d2cce26dd6
- MD5 5b03ded0274e4709da5235d856f212ab
- SHA1 f60b6f76b7ac68888adc740c8c958ccd53f5a6ed
- SHA512 a4b2973f5945db514189ad132500a697f0efdd0c188f0dc181d1513542d6f1062e493f877293407fa870cd5d01b40458c3a9f6e38d1bcba1fbe35281938809e0
- SSDEEP 49152:ZhtSn8EApI0figjgiDn0AP5wTDmg27RnWGj:oX2iWphyD527BWG
- TLSH T1D295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.5MB
- SHA256 6c3d1825c36962a58dc819e3f72c3ab21b759951bec945e9d10ffcf113ce926d
- MD5 388457b51b425d880e5b41e8b433a11e
- SHA1 3f2c4c6df24eb058f708cb6240adca2552a114e5
- SHA512 dda7866dbed6cff4f1fc644067672b50f08ed2b93e334ff52f794cf997d7fb29223f973c423ed1cbc3eb062eaaa17cb7bb07c7bcac85c30b442293e71c4e2fb2
- SSDEEP 12288:8sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8ssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1176523BE915C01CAE52649B5C3E5F14EAC173E57E92004837B6B78BAFBB14584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.5MB
- SHA256 70e3cdf9bad3aaf660c70fd01b68e67c8daaaed6900d25026891c84d56050461
- MD5 8ad95a16d803c3a0efec0b88ec303e8b
- SHA1 0d0ac62f1f83945df0de81be73a8db635ae244bf
- SHA512 c1b0f116db16d1a440dd26cdc9415300f479a9f9d0fffea71c03195a332e28496559b58661ea5dafc0079ce97b6fae3bd70d3cf08de8eb6ae1918c7e8d123847
- SSDEEP 12288:CVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E66523BE915C01CBE52648B5C3E5F14EAC173E57E92004837AA778BAF7B15584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.5MB
- SHA256 078b9a9153ccab68f222a44f22112e493e6332ca9be072ff8049aa827da4b28d
- MD5 168e46cf4f2978d10a81a3f2caadc7a0
- SHA1 d893031db8b7c7f71f14839670f034721b588997
- SHA512 e855ba05a200753429c90aa671d276569439ef93dbf47723824930c891493537b20338d2406d6a76e9a4362adda3ccec3df18b51478f0f85bababe1b2e340def
- SSDEEP 12288:eDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eDsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1146523BE915C01CBE52648B5C3E6E15DEC173E57E9200483BA9B78BDFBB14584B3C862
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 db2f580f1d08425ba66efb194d6b7da7591171010f13df04b5a634dd9d619860
- MD5 8071be1d512b4bd25944738ded102784
- SHA1 213b419360f325e385c155d073e778bc70d96f41
- SHA512 d13a25cb00970394240f4830280dfbe4456609f2f2ea313213cea733c3f86c17894079afa95fca1af46e681e2dc1843f99d5baeececc62f01c87f0c580c35bfc
- SSDEEP 12288:lVyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18175236A535C01C6D87285B4C2F6E11DF8237D56EA3005DB6B532CBEAFB16944F3CA22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.5MB
- SHA256 f19a9759c51ad9eb7e610fe29f4a65040a7b8334a1746e2b64d8557ead351c07
- MD5 bc5386f4a2ea164d25f27a08b60a3a5b
- SHA1 4eacf0ca1768d2d43cf2803fd5ed3ac5b7b89562
- SHA512 6749b1bb42d9528d30d9f60abd58374b69c02a200e2ade9d5d8f586da468f2f18a1f68cd02ab7aebc7d8fe7b249cf744042b6b9e5e0b9480d1f4edd992dff48e
- SSDEEP 12288:5aXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5asqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DF6523BE915C01CBE52648B5C3E6E15EBC173E57E92004837A9B78BDFBB14584B3C862
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.5MB
- SHA256 5c86ac9225f09037cce3af2781bfc0d75720e0bcb54880e3be0fbd2d7f878c22
- MD5 a02e5d111d4ecffe33f8108a7dd1108d
- SHA1 edb7d9c5086c93af1ddedf6cec2e38f705caeb50
- SHA512 d120d817c8909e6ac2258d3203b78d0e585890e69731e4c64da65a2edd16b1e09a10450bb1c2b1f070dd182b3bb923ded877806e20ee8d32b45278b2e7a6b8ab
- SSDEEP 12288:VpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VpsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C96523BE915C01CBE52648B5C3E5E14EEC173E5BE92004837A9778BAFBB15584B3C827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.5MB
- SHA256 142dd6086453a0b2cbaf4892b61911d9cd7bce3a61cba2a94264b24188f4c5a7
- MD5 cb0ee5e98986943b719044125264a0a5
- SHA1 4e3f4cb5ee108660fe76710ef14d9e4fc5493181
- SHA512 45920a8e98ffdb6d1bc7d00d0f6cb3c6aa5164d7c9cf812154409a4802ca39cfa693a20c50f0002993f2a3de28a8ecff8363b59d7ec1afa78070063df5293fce
- SSDEEP 12288:u9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u9sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1576523BE915C01CBE52644B5C3E5F15DAC173E5BE9200483BB6BB8BAF7B14584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 57ea6bbe8ee357e1fe08ab21750406957e6a6783f78a47dc7bb49a7d5b3a6665
- MD5 cf7760b41c93737c10bda4009718de16
- SHA1 ef101bb2e92e7e606ea2b711ed9157ed2790a8fe
- SHA512 aeb18999926d356fa4baab0158ab26e410062cce930e7f3eedfe5a55628f9680cfa08d728119cb48b8aea3247d35eb9ffb71e43eb2bdd7d8ad52efcb6a476f99
- SSDEEP 24576:oZM0zFVSO1sqjnhMgeiCl7G0nehbGZpbD:oZM0zfdDmg27RnWGj
- TLSH T1278501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.5MB
- SHA256 42c5651238f53445175a6ef16b51e21b885af89a040e71cef43adaefe561570a
- MD5 eaf50d39e0c4569b5d68fd70ee63feb2
- SHA1 c4fca8e053a18b802c30b16a0e2ab13863e0202f
- SHA512 0c3deb68ff0b4b9162238adf9a5f75a9938921b00f2788257eec02ce13f4a901c37454d5f89637ad3187c0f26728cf53ff5426366a43af1fb2d548805ac037a9
- SSDEEP 12288:r4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r4sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1B06523BE915C11CAE52608B5C3E5F15DEC173E5BE9200483BA5B78BDFBB14584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.5MB
- SHA256 8e5dd48114e0c01eeb8965572dd7cf1925fa0a2ebe959c629bce137a3f749d4d
- MD5 e35f146dde0d6d17724d736aafeddf30
- SHA1 960d9c8cc0850b9057d5290120389cbe1ee9cbca
- SHA512 b312486da2bedb006c6797a10c8340d37b5091217da3463d046fd5f7f3bc175a389e6a2fd828394f05e4fd47d3e9c660aa20674fbde8d2eb9b4f43d0425d576c
- SSDEEP 12288:5EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5EsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1ED6523BE915C01CAE52648B5C3E5E15DAC173E5BE9200483BB6B78BEF7B14584B3C827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 ec3426345779e38aeebaf1a0adb24b70af9ec4cc21129489d10d1b98b74aa8c7
- MD5 de578404b6cc71e73c9ea05ab43d037b
- SHA1 9dfe2d5dea08ba106ec75d0adec9e4f949542602
- SHA512 0c99aa9683b792376d3ebb126bf3aee09ebd41b855526827cda0cac19fe7c12d949d4e4642af99f28e11b0f7883196be8225af3076e3a2831d21c4fd8af6d74d
- SSDEEP 12288:UyPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NzyhsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FB75125B73A530F9D1378178C5A29A06F7327C3647204A9F17A516BA6F336908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 09ede682de012067b4d7cb3cd138eaa7440863c04d703ccbaffe36f6423842c2
- MD5 f56f8189f033782453f2af106c555c8a
- SHA1 fe6287baa3e9d507ff1daeda3bb2d906f6466af8
- SHA512 659710048dee84b85a5d31e073a2dd87ba632a50068da41ff0936325e9bae7d2759489a918337f1c2d0d72bedf19c2d6ff53b400ef71f9f04aa83c928ef216b2
- SSDEEP 12288:H4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:H4sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BC6523BE915C11CAE52608B5C3E5F15DEC173E5BE9200483BA9B78BDFBB14584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.5MB
- SHA256 de83cf6709e0fd48052fc5db569544aa39c374c02da31346e03c5b5e559397f7
- MD5 9e15ae60f2ffa47648221bf5a18f88a9
- SHA1 a65f02b89d040af368f9b3e2319cf358b8290d4f
- SHA512 37e19bba655650ff46988ea12388d956f2116a0f5e0618806437948eb41ab72292fb266806d6a491b4518d000a8e8073e7fc1ba08e78b252508f53f6c0c1896e
- SSDEEP 12288:z4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:z4sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1A26523BE915C11CAE52608B5C3E5F15DEC173E5BE9200483BA9B78BDFBB14584B3C826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.6MB
- SHA256 0fe3431b5c0739a5aa80ad68ba4c4724f86c50844e819bb5293059ace7d3ea91
- MD5 83b0f9ceb654a213ac9df0d38217cf33
- SHA1 1f46b67d8bfc3c432081fbd59b6c62d3e013d92a
- SHA512 ef25287d17135b9a8c01cd2df73f4afec7faf7bc3b31d6e577429e0065c0cda4efcb420cea018fff18005e7e2fa86d9fc3a73bea8c4c70869e7627b2160865a3
- SSDEEP 12288:myPz5L8hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzyhsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16775125B73A530F9D1378178C5A29A06F7327C3647204A9F17A516BA6F336908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 26ccfede7190f3bacfee01cb29dc7a9325187d8647c454dde333f83ad68897a5
- MD5 c1d526b70b523733f2c3fc12b1f166ee
- SHA1 1cbaaf60426683f9275883f2db7dd6ad397582b4
- SHA512 2e65dac98dae9f030e7035365d0fadcd5738662dfe790ff5360c15e5048e7e26b3862f39ea9ba29ced630134e482c61210ea9b9d40e8089a12ea7b9e94af4a20
- SSDEEP 24576:OcP4mcvIjkGOxhKP2l71SNKbrh/8KBAsqjnhMgeiCl7G0nehbGZpbD:pP4m4IpOO67N8KaDmg27RnWGj
- TLSH T1AD65BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 19ade753c0b6e41ea9fd74717032fb7948e63a4e63d7d6ba49dd109d49bcc3fc
- MD5 d258ca5cbe02aac2a1ce566899eb299b
- SHA1 9acafb20824599d01cd953e2e2bd68b51fa845a2
- SHA512 d7e01c6f4b9431e1e2751f485137c553753db30aa4816b79688d9d069c0ab640d35061634e7212a2520be4ac7cb37590de96fcd7031ba68333da50fbcc63dac0
- SSDEEP 12288:DTsfIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uIsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13975015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 37e5c73aec5886d00c0147ed335b2661a5907702826bfb85e3527b89bcadd567
- MD5 5991ce1502bd8bb8bdc57d5b46109671
- SHA1 4c8d8f850813f17c00fe8e01797d098f72400f3d
- SHA512 0a2536c5685059963c5ccd9712ff6c3ea7fd3a826c8c6836668d943169a8060b409b1dd650e7ac11110a77bc1e64802f0831992d9b1cd106cd46ec4c75adbebb
- SSDEEP 12288:8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8osqjnhMgeiCl7G0nehbGZpbD
- TLSH T12E65237EC35C518BE57609B082E6E12D781B3E669E204483BA5378FDFAB18948F3C517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 2ededdbd18dd60357c149b235e06a7eeba16cd1c4dd885f9afd31fa616c45bf3
- MD5 81ebea50655869ca4f8d9817bdf7d412
- SHA1 b9fd3b266c6cf7830d117727d52da885fde11a68
- SHA512 bdc6cc4266ee81718d77ca4e307a950c22de8e7c098bbb250928c4c36aab0d2c459e6d4a900cf31832a5229633e6cc23c777a8ab6c7f77c3cdd1a87a192f1ad1
- SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQuDmg27RnWGj:Sa0hNYG4Jw9D527BWG
- TLSH T17585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 7158e58b6dac2817e434ed39b4eb6ba5cc054c77a0314356c99b0a0f512e818c
- MD5 ed23e20dcb679c21a2a463bc084fc8c2
- SHA1 f6692fdf424b9ca4aafded0b01257f73706023e0
- SHA512 7278c370ab47b21a2e2f1d1e365950af49b3f5914f1c7de5ac2d9b49079e9f1bc9f9b80e7b18527d33a53ffe80b828a714c714def5e82f430b4fe306606eb320
- SSDEEP 12288:mhbHjfXlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mhbHjPlsqjnhMgeiCl7G0nehbGZpbD
- TLSH T18D75027E12AC20D9E572917D8296D10AD632BC261B2053EF23D281BE5F37EE44D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 f8b2c968ef7383a3b5abccec57d8aeacba107f7703eeffa597807f68a2ccbbbb
- MD5 713a02361227c84fdbdf3e532b988bdc
- SHA1 35ed0ccfbe27c4872f79dd056b6ceb6ccd69e9df
- SHA512 da5910655ea4cf06de3e2954031b0e248fc960c4bc738552e8699f855ceda4ad772b6e225120df333c38b934e2afb1e547e1a54a4aaf93741c584927ccb29966
- SSDEEP 24576:v3YgnJcRTk4yti+R5dpR/tsqjnhMgeiCl7G0nehbGZpbD:vIgnaTk46ppR/RDmg27RnWGj
- TLSH T12145BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.5MB
- SHA256 90021bff5cc1be218157984b0e10135f63bac0cfdc60f65d743dddb8b64c80a0
- MD5 e6ca2b23f952fe1a72c0f6dfc09fb0f4
- SHA1 da460956bb48945a6d3ffb6a19ca88f582f067d8
- SHA512 4b48d5a32f37b0e29ea83b8647ed382d1dfa483aea1fa3c6759fecc1b616b6f5010cb4774ea3cedb679249b7ce4b25ecdd75cb22b6b174cbbea569e85db9de45
- SSDEEP 12288:G0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G0sqjnhMgeiCl7G0nehbGZpbD
- TLSH T14A6523AE924C11CAD53649B5C3E6E11DB8073E569B2004D379A778BEE7B18D84B3C523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 0a3b7ec93e6b146ac05c72f182416a1add499e63151c23e73b4f37914ab5c91f
- MD5 725a80b61d24be43c32234896f3a3bcf
- SHA1 b3ecfa0edd4036c1a5a4e2e1d964838aea49f072
- SHA512 28178d47b60986e0ad5c1143594103aeafebff41f1bcbde871d1a3f8d52707a06f2ea8d9ff0f9714d680c24ce58c968ea1cba06cb247ee309b042e13cf5e8475
- SSDEEP 12288:1ObfA4LWOsvAYFTvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ybL3UTvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T107950159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.6MB
- SHA256 1f2f6002b96059d4c9770abca4353a5d0990f489f0266766f1bc9320b4618cb8
- MD5 6559cc8e5b8263f3e6ed691c78d6aac8
- SHA1 13f19b414bc6833b4879c962eecb46753742c94f
- SHA512 668d020d2f086c3b7bfd60cee5db68d2453d9819d99440ca23abff916fab511403cd79de6ce47ac5d060911f8bb6cd0714f2cca9aa63f99a1f96759004ab2389
- SSDEEP 12288:8pFtxOrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SOrsqjnhMgeiCl7G0nehbGZpbD
- TLSH T19E75022E32DC10E9E536917CC692D20DE6327C660B2117DF06D180BE5FA3EF85D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 097ca845f8b93e4d2c36020612ad45f90dc9b25d0287587e51cc0494f8f186e5
- MD5 2622db5c1c573d57b2dce1f6f7a16b35
- SHA1 89bd341c46501fef29c731ba28047751e31d8147
- SHA512 443fcb2a99472394b883835088ac93f58a18297b9184c51324d2b57a63bd3609bab2bbda861e0fa5c6e6e640527618a67247e323e8363e04a297ed41e316a458
- SSDEEP 24576:w7NM9YmZqmWMUkPjZM48Mv6bEhs4sqjnhMgeiCl7G0nehbGZpbD:w7cBWMpPjN8DbEh5Dmg27RnWGj
- TLSH T149659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACB1162833E7F37AE44E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 c3404efb28acfc4cb44fd9ef93ca6d80252887653c6d85ac1ca32dcd36bfd50b
- MD5 d6b387ae864ddbbd2d5bde70a9cbe24b
- SHA1 4a654e55d9dacddcdaba2b4850a176141e13b9c4
- SHA512 8c79e9e755bdd1d633937de719cf8c3b036e01b30b5a151b382b1de7df0627f2a20a05216d9b32dee959053f49e2c0d3558e928e9698b4df9ec2e8a5046ea793
- SSDEEP 24576:/W6BApg2YuyuNDYTabvcRvNYf8km1usqjnhMgeiCl7G0nehbGZpbD:/F2YuHNETovcvNYf8kmEDmg27RnWGj
- TLSH T150857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 150de754247512816307068716e34807800a6a7728312b278026d98274929f78
- MD5 e3384b186d18dfa1003f6ae4f0059b33
- SHA1 326a430aebe382c44467be03455ddb3965b3b64a
- SHA512 b74421355c36a115a8d821dfff0f941dc3022f08b4f03d139d1c09461b0e558423ae592ad0ee941bb17c2fffd0bc2fee5068a8174a659371c493f84d3150161e
- SSDEEP 24576:gAFs06+Omlf8NXEbTonsqjnhMgeiCl7G0nehbGZpbD:1Fs060loXuODmg27RnWGj
- TLSH T1E765BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.8MB
- SHA256 3e96ad0627dbbd5355e64ab2cb4614a45e447217b014a84f9ae774c0444933f9
- MD5 f3edc5f945d755e8daac4c6be49bdf14
- SHA1 7255c495baec9d14dd45b0a1f49cb2ed9ebf4a93
- SHA512 98873330a03aae32ab1da1a28536fc045ddb06dcb492dcf1b88e63aa53b9fcfe6c61a52a6c3f0d3903114ce26f03b594710fd023f81c414a6c86a01a8e671c42
- SSDEEP 24576:OJnJ5D3We6sqjnhMgeiCl7G0nehbGZpbD:OJnJ5DGeODmg27RnWGj
- TLSH T1E885E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 58062aa74621b5efdf38aeb9e8307448eb9803eb9d70308bf338203aaf9db99e
- MD5 5ccb6114b1c1947a9f9ed2324144eb9d
- SHA1 c5fec94c7a0bd3a03ec19eb671bbf36e5e5b93b9
- SHA512 1fc1694b2edd5cdc0a52cafef97fde859503b63b39f68ea9ccf30ba1772ffc1a2c0004b8f25172223189750d50d949842654ec9d5e9e4249d1da0439b461db68
- SSDEEP 24576:yEPohm6/7IIXdwcXrif7qQncjlP65i3VutsqjnhMgeiCl7G0nehbGZpbD:Fo06DIKdwc+eQnSt65aVYDmg27RnWGj
- TLSH T143955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 d391e37580e39a07660d7d73d1b079027db2c8db41319e8b4b834ac12a70f288
- MD5 9e63c2e18ba5a0138f4d8d44b4750001
- SHA1 7b390262209ed761b84b6cc22e4843338652798c
- SHA512 7a73a787ba99634379541e17029521fb8dcfac1147bf030ccf52dd3e2ab86e81a5ef9f1f6ade0836aede983c06462a42ff0f3dcc030b7694d656c72c79b0de24
- SSDEEP 12288:cEP3RoGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XoGsqjnhMgeiCl7G0nehbGZpbD
- TLSH T10475126E679C60DAD126907DC291C209E773F4716B2127EF16A2D17E8F739E80E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 b0c31ec0bceb84550e617719de6cf1bbebe3a457d5902c58ee502e6a894f9421
- MD5 a92d93920fadd0158be7c62950713ac5
- SHA1 a69f158dee9bb6f690a1a3aa616a4e1d1c429d6e
- SHA512 8ed5f223a49d6ffd521db5db23d274905b9d447b7db1a951afea5503547d45c05ac5a078a88d11442b09866bde7ea82fac5c0cc1ab1e7888e7d5163646dc2071
- SSDEEP 12288:qjkyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qIyVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AA751259639C60C9E5760578C6B3D1989C32BC319F2046DF6191FA3EAF72BD48E38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.5MB
- SHA256 ea05263e7ec6980b358995bf486bd2de9deb5cd19ab60c7df2a493d8ff12c58c
- MD5 64eb27968ceb6a17036e4fcd7bf67eaf
- SHA1 fcedafadc876d64d6333a4341394e8430a50c766
- SHA512 f15f7dc25d982853f92670b6b8d312b5b8cb97294ca76a8259fd735c87c5ff196c8843472a157dcd1cb3573a652eb8a3fed2b79ea7711a66b7e7c3d6ab83bf01
- SSDEEP 12288:h7bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5bsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D36523BD525C21CEE92245B4C3A5E21DA8233D366B2014E775E7B8BDEBB24D44B3DC12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 7689c283cf73d50cb52ad03ce0221fd5c1a7a219817ef7eb79fb3c60bebd0262
- MD5 bc9e9489a28fa0e5c330487d17bd2d06
- SHA1 13e48751fae986ba882e9ef198c5758120484b3a
- SHA512 60fd5cc338e6c43326b653d517babf54c57f63e12fe96f3e9c7977377c652f25e3d3ac5e3603e3efd30834edc6b0ea5e7b0051fe425cdff10522ffad76957c15
- SSDEEP 24576:PQ9MxZKdcz97w3QsqjnhMgeiCl7G0nehbGZpbD:PVKXMDmg27RnWGj
- TLSH T173557C2DABE9058AE177D275D5A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.7MB
- SHA256 d17e434dfe0973d5118dbd5037a32d18a0a5ec58eb6ab1cf525db774d2e13a98
- MD5 7c6d66d740e11189323f54196b813006
- SHA1 8677acc455bddacaf7a02882e02223e4eba1ccdc
- SHA512 6bfdd44a839fd0462d7a4ce31c77003e2711e27c8095c87cced55561405d63b0825106620615676031eae7632a4f413539d616c131b200062f641042541ed8fa
- SSDEEP 12288:WyoKo2gRple9pxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:WyocmApxsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1C485E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 7ec1ca65f112121a3564f11449c4693427c83185cdb1c1dc3cd25fa724146691
- MD5 51df71c5a5dd9023169d7f95f639f217
- SHA1 eec11d28622a7df0954e6afde89c45298aa8b51a
- SHA512 5f3923b76a8520d7e906bf4553f29d5cb750626d772cd5e359aa21d3859d29a8d37806dab5bd38752f67a703f2ecf7139b562c6e99dcbd769a73d952438058ce
- SSDEEP 49152:0WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKFDmg27RnWGj:e0zuNIBD527BWG
- TLSH T1B0A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 348c52908252e04ff57f397357312336e997676430c7a2468ec9b5c63209e53a
- MD5 5927eae061dcd54a5ceb1c47f9889944
- SHA1 460989ebe39ec4dfde358fc9d5e54bff9bec4cf1
- SHA512 76918630f4879edee7e5bc9f46f715721c2b1706e034d83ff233858d90c61f4214c6b41ccafbbabc0f59bb0114f9a02bfdc9dcf67476ef1a39f051114c666c69
- SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYzjMqbGsqjnhMgeiCl7G0nehbGZpbD:pTDxR+N5YzTBjM/Dmg27RnWGj
- TLSH T1E255B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 8c0860ed3defa2cdbb124c6abecb3fdbfe24e7983eb8716bbe05cb763b36dcdb
- MD5 f98d57619c81a2141ccca8413ca4469f
- SHA1 3a8e7596253a4196cf3d9b4b047d2b50a8350d28
- SHA512 26e8bb830d4dfdfdd5a0c1056d921097b5f374b63c656797715e7552294e16b28f8c398641009ba5051c9fa978583035d543432a92a18d9e5b7710b59c4c9f7b
- SSDEEP 24576:uTMdOz0FFS+9mSLysqjnhMgeiCl7G0nehbGZpbD:a0K+9mSL2Dmg27RnWGj
- TLSH T11E85E07EA36D14E5E47BC17DC653C90AE9733862032166DB0690C0B97FA7EE46A3DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.5MB
- SHA256 9b35c9a8d99f0d7dfcefbf837eee63170d045c4976551119d42b36c051d5f90c
- MD5 d69fe97d70acd13aa669ff0428358d11
- SHA1 3416d11d7c9e4ea8e3565d10d9661ee72ab96b3d
- SHA512 018f92269bf4ba442c250c808ac628b29ddf6e3d2a76dda307252935da8415e4479513fb68df78faec63be9e72df01d33045b6c698d8fe18e0774db76fa0a76a
- SSDEEP 12288:04qvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T17475126D53EC30C9E4729574C6B6D10A98327C36272019FF35E2D9BE9F729D48A38B12
- MD5 SHA1 SHA512 SSDEEP TLSH