6b9f8080d16360a5260fce7b6b6f427c1318383104b560daa4cb45ee8f6a0455

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.5MB
Sample260808-dn8lsayfrf
SHA256 6b9f8080d16360a5260fce7b6b6f427c1318383104b560daa4cb45ee8f6a0455
MD5 8efda628e40c7a9ddc9a390d571d300b
SHA1 59f6fd894f23136ab3b8c293513b9b0bfa1018a3
SHA512 863a9cb5d35cad364e92bea9959797ad54d3b52a54d6919c9212aacd0d475ddb625ad356a91a6acf10c01de6f7afc195a7041064160fd5d074ae3a18840597b9
SSDEEP 12288:EogZ4KS2L0q5UPcU1ODtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:E/ZY2L0MVdZjHhQ6giafmvJW5
TLSH
T1E1658BB6F9CC88A8DEA00AF9273CCDD0656ABA70CEB044DB534465B51D2B2B0D571CDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4728	alg.exe
4588	DiagnosticsHub.StandardCollector.Service.exe
2656	fxssvc.exe
784	elevation_service.exe
4064	elevation_service.exe
4528	maintenanceservice.exe
1136	msdtc.exe
3672	OSE.EXE
4580	PerceptionSimulationService.exe
2672	perfhost.exe
4872	locator.exe
3856	SensorDataService.exe
4656	snmptrap.exe
4348	spectrum.exe
2044	ssh-agent.exe
752	TieringEngineService.exe
1060	AgentService.exe
3020	vds.exe
3528	vssvc.exe
4900	wbengine.exe
2460	WmiApSrv.exe
4168	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\88412cc9a19fe9b3.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e587e84e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e755e85e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecb3647ee326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3c8587ee326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005319487ee326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081ba8084e326dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0c62e85e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004554437ee326dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dda4ab84e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e616677ee326dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeAuditPrivilege	2656	fxssvc.exe
Token: SeRestorePrivilege	752	TieringEngineService.exe
Token: SeManageVolumePrivilege	752	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1060	AgentService.exe
Token: SeBackupPrivilege	3528	vssvc.exe
Token: SeRestorePrivilege	3528	vssvc.exe
Token: SeAuditPrivilege	3528	vssvc.exe
Token: SeBackupPrivilege	4900	wbengine.exe
Token: SeRestorePrivilege	4900	wbengine.exe
Token: SeSecurityPrivilege	4900	wbengine.exe
Token: 33	4168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeDebugPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4452	2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4728	alg.exe
Token: SeDebugPrivilege	4728	alg.exe
Token: SeDebugPrivilege	4728	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4260	4168	SearchIndexer.exe	112
PID 4168 wrote to memory of 1684	4168	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8efda628e40c7a9ddc9a390d571d300b_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5112

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4064

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1136

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2672

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3856

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4348

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1564

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ba136511c8b6bc5d70a7eff68967209204c81dfed1fba5a35c2053ad087a3c99
MD5 deabcf49f255a209df53dff133fbc42b
SHA1 cf90c9265e2f5c40898eb0c433d8dcf23f40f99c
SHA512 866732588cb4016870799492621cf47c2de497b547b8b587ecba2d9e4799981d161a50e4643d327afa8a4c8a261251c36fd3ad600634c937f09584a6036d2008
SSDEEP 49152:Tb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnO3rtgiomvJi:x3q60jB1xjNi
TLSH
T19ED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1e999895db1211ca71fffbb4c009bd1a856042758efdcf220a9dbd736ff86e4f
MD5 f58a57c384ffd1c6fe0c30710400e2a2
SHA1 07ed9626979e32d6efed0016684d91ced2c75abd
SHA512 617ba8f6d5230c7093fb91cdefd84156d6ea83addfd2193f79129a144362ee86400764d78240606f5add13101df255f62e4a66fe88a9792e18f2d05251dbdb3a
SSDEEP 12288:q1XLsswWkxy2lRq2czAdDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:gXYfDtczApdZjHhQ6giafmvJW5
TLSH
T14A65F129A3D508F9ED67813CC9A2C516E773BC914760E78B03E499651F332D82E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 18486bdcb851bf2ec6dcf9df3ea669d227dd7776cb8daf9eea1771a22c7c4eef
MD5 3f129eb565d9c46b1060e62c8dfa1137
SHA1 50364ff271fa40e511e305493053eaf1124c3dd7
SHA512 4b9cd32d9494aad5e2ab095bb113fe9384d34f9f3af95b87793dfff270f07a0d38db077399d3cbc239c7b40dbe335077463e1cbbe9c1f15ca54fdd9c8906322e
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVuqrHssDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoo:Q0Le5ji0hmxNrMWdZjHhQ6giafmvJW5
TLSH
T1B485AF16F5748335D073C0B9C5D2A69EEA7230825B308ACB4286D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3e056267c03f11faa3e42b3591f14533ab53e7244aa07a64066298912fcf4a57
MD5 4379dcddc72e7b238e3d54bea735ce40
SHA1 e195fc4dfc86f3626f9213ec256e261da064b75d
SHA512 4621f052fd7a61b3e952bb61152e0c77e5e3d2f2082bd987b37cbaaef9b66910199703e68f690280e26d00bf1b7cd11fa17451fec5a54fa267f279a0cfe3780b
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWr6q8wyuIdZjHhQ6giafmvJW5:o/ezSC6vUzPviHjyr3rtgiomvJi
TLSH
T137755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0d7f77e1881c4cf8510c38307252a98472f3f7e52fd591cfdb96bdb53f1478d1
MD5 ef9e7b987c1fa7bd756e320b8644dc8f
SHA1 474e1e03065111b52ed42a499bc99b4a8684f7a5
SHA512 0547153baf46b95d868598f2bc22876b8c977e259bfc3e792e3a7a0838aa0f037ea2b0bbf1afc5da42efe4530d4f765f085743a797422e01a99ec568c03b8521
SSDEEP 12288:NVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im985Dtm1aUiPrfUQhQ67sv7mfYTpKo:NVbqPb88hv/l+bldZjHhQ6giafmvJW5
TLSH
T1C1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 991812e19c7522ea1749db9188a834268a2f16bd89c6e97790cd7ef45f694138
MD5 32a59ccf6f82bdf27aba8048298259f9
SHA1 082a0ee675a8bdfedb23d777aa1e40b99fcebad6
SHA512 4559a126353a3ae98ce89acbd903ccacec9ce1ee038e3d95308d743ee97999bc6656f082627bbe7e335a699d67d4b736cc7a2dd5e11df6342d79c5a35fb55b47
SSDEEP 12288:7jYDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:7jCdZjHhQ6giafmvJW5
TLSH
T1D745234BD616A0FCE3A251384637F5AE43BAECD49D800F079FB97DC154BE0A8794684B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 a7abbdb3af29db2a5a633e87d748d01b879c415b19b2abe20a1f538e657cc1ab
MD5 122c0f17c280c7b0dbf8edc8d26b6280
SHA1 fdfd16d47b1ee315e561bca56f10c053e232f044
SHA512 084d7cf3cbe2cca151e0f102a152fed2d25e89d1a301bb69f96a11682ac76b15651a065ff5ed1ec0b551123882fab9d8640539fed0c4b69f46103d25ca136846
SSDEEP 12288:YeBNUbTVO86URDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:YJIUNdZjHhQ6giafmvJW5
TLSH
T10B65CF2BEE28FCE2C27A9DB85651C640D77278704F6293CBD175824EDE235E01E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fb7d6681bc91693945a78ba1020c3798a6607a1728021c408dfae62ee8ed9a66
MD5 acdaafc4b4f0999d58e031872be289b9
SHA1 c40ce0fcc034493085d2d2ddc115adfc1af29d5d
SHA512 783656f5e610c5dfe26b81f9edba1cb6a2982e7b6aa75d2f528cb0966b71d036cf5c221dfbff1a281fc1ed1589890085b61fed4b21f92378f22669e1e848fe18
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THI:VQvGAdlCEL8c/RRNw5C4xjNi
TLSH
T16E266D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 58b2164032416c63a02f5c584f782b36f22ac31a1aa685b1645c9bbfbdabfc94
MD5 81468624c4994bf178d9b97cf6eba58b
SHA1 c287d3cc45e31ac5bab3a0fe9a6d8060d5a068dd
SHA512 e0ad588073fa2b1e575cbfc12b619447dcb553800995476e4f53cbfe386ff311f2fa13feb98f7a3cf7a406af120fecc92f38aa2ad9e8a615ed7cc5ef6375d4f8
SSDEEP 12288:6AwSfxL/2Dc3DDLLmt0LDQewsAjLDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:PSewsAj3dZjHhQ6giafmvJW5
TLSH
T12875EF31FA74E036C3BB0DB61B26D716147DB9604F911AC3E3E89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4946b3b35e06e5774fed5de536c2a16b0e84d2a3f2d2a2508a9ed48763bbf09f
MD5 7a0acc9ea65cc13fa133ba1a8aa544bc
SHA1 dae5d1555590d0614ee3f85b8402cecc04622269
SHA512 9a020317ae7e3f79bae7b57cfa2f88641a8fe6fb0efa6167c21d1b285d1192296ec742eb1bce7a3ce1481f57fc307001259090b5d4e7e07d04bb6a2b75a581a1
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH5j:fUEtQevvqc2W1cpV2RI325
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dbb9f454b248768932f40e7727ca2ec69abf41e67941d918bb0f845eb47f54a4
MD5 5de3bec3079f92a6fc9d713603daaaae
SHA1 7bc5545fbfe07da8b105503df83e083ed4051a37
SHA512 dd4fa8224412e178f260f709c7170dc7e7a045678613e2fc8c19895c2cc2864bb46dec550c32794683825153822c978d06cb0eb4d5077808f728c6ad74ba4af1
SSDEEP 49152:DCbRquA/m2yL5zTfFiV+XenmE3/zX3rtgiomvJi:8oquVjnmMxjNi
TLSH
T11ED58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c5ed9b8ab42d6d6ed93cd83c66599296364a74b90752743964b6cf3e81ea9e12
MD5 38ab53f1d3239a3f11621732430ad9b0
SHA1 98e66b026399f8a2da4240979ad7ac67edb49c4a
SHA512 f411733c2dbf79d09f37a2a12082752939f7a7b6d58c5255e8b754444d25e3219aa912bc325ae95db01efb68eacacad164bb0199fc2e11c583c73e3c0c2569bc
SSDEEP 24576:CAhGL2IFoiwtA5l7S53sdZjHhQ6giafmvJW5:CAM1Foiq583rtgiomvJi
TLSH
T1AB35AE81E7F955D4F5F3AA7899B69171EA76BCA65E31C20F2260D10F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0f8f4ca670796659d94352f7313db6439e6ea194ed97d941f236b6d6dca7ed8e
MD5 8aad64f943a8954a5638d04cfa599ff0
SHA1 7bdc5c7481963ef7af66892da4f9a79bb1e9343a
SHA512 48c76f2bd3d5e6e6a3bce687760b5243f122eeb8d8eca9d06540c8cf0e963f739704842c557a9a18eef4d2bf1764d2b004ffd033947379613fbc62febc67d62b
SSDEEP 12288:omw5HEjsChNSBFgl0WDm+CGDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:FwuXOWLdZjHhQ6giafmvJW5
TLSH
T19365F14A72A51CF9E6A781388657D136F7F2BC412A21CB1F17A0CA5B5F372607D1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b4b9ed6d2867dfdc9ea6126fc64a51abd161dd5a3b4e77a331249500a5713d14
MD5 fc88437a51cb29715ba22d275eef629c
SHA1 b9844843e2e8fa3d7fac94f073d0c7cb04a2d7f3
SHA512 85a1648a8e1c47352ebff1d40298b734542a14d554bf6e5623e7437382c7be31a983779d7fc9522df0420ce08f72e4a7e371997f69fe56bffa3a52fcedb80059
SSDEEP 12288:+/Z1Iy7Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:SZu+dZjHhQ6giafmvJW5
TLSH
T1CE55124A32A570F8D2A3913CC9B2A649D3B2BCD16B7103CF1B655E961F772D02D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8c18b0eaf5583aeb138bbd6ba266b126c9845cc4ee15ee1441e14ed9a7883e2
MD5 4bee64dc1101ded42e0c3630109f9c1b
SHA1 e13e745126b02a62f5c580e4126fc052b3fd5687
SHA512 3bebe0a299ab935acba2345b7ff3cee3b7d79730ac23da894f8fe6cc6b674782fda7752d5ba3f88da90a6f2797ae034deafa81c87b470d27885465e98094a37a
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UM:1QRQyi36YOcPhLvw2gAf+PN3RxjNi
TLSH
T1BF666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d53f2d46e13e6ba720ae51312dc25b17f4ee22ae93f0754c83c2552c09ec079f
MD5 10af80e56fbef2df106c9e263b32014f
SHA1 921498f89fc9bf863b489e1b278169be1079a6df
SHA512 b03e3112fbe647bb5280fad7049c80e358ce5d8dbd245c9e765840ad1e20b7a10b1951f03f68ee8c65dc56fa8cd7925c9da3fcf67eb22bd9cd5f9a169acf077a
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UM:rQRQyi36YOcPhLvw2gAf+PN3RxjNi
TLSH
T1FB666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7ecba305a0aaf276a1270b88d4e71c2f1ce98fd5a88c68567c841c356a80613e
MD5 d247eecd193324e05fde060f0ae31507
SHA1 076134fa8d1c6afcd9025dbb926e1ce79f4818c4
SHA512 975d2ab918aaca2e334ae9f51df357cdd83f0ca049f2b7703b86dbc98bc4bf30cdc382f573b412f295d7c48d3b857c6cfc12386041d0bceb9d1a5614bd18e12d
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0OdZjHhQ6giafmvo:m68Qg55nhceWu7PNU3/H3rtgiomvJi
TLSH
T1BDB55A33B2F600A9C44DE1769F4A973196E27C758FE0D3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0492434f5fbad0418c79f30f092cd561b58af9991031b79dcec9e9b7cd29ea91
MD5 0ce7af0fe25823c8801029cb71cd0b54
SHA1 32dfad0be819fd059be949ee9e509366b0bd95d6
SHA512 2ff843f46758adc74913d4b00bf20a7cf9d34188e1e7745a99a5733459730fb1215973a1fc3462ad1d588514328edeaca045ff5468cb0d269f2d765242fb208b
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99G:Oy5112gYy5azzVva69nLKnhZCxjNi
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a157102741649a7b50950ddfe07be84781c31a1b10b01245071c890557d60400
MD5 f0ef2d270824fdcc5062f84fcd669f50
SHA1 65fa95d6a50663ceedea3de77f611f31f6715758
SHA512 45f5c8e1fa1a36c2876e5a611390a00a6867657df9f8658a9a093f341e98b144e263e1c979a1402b1516099e2304d4c58d6f5af1bdb9ad7986b8c84c995f0c96
SSDEEP 49152:9B+taZ3usBWOBr4tEG20bqx0z+n217aau1gl53rtgiomvJi:ju6JmUxd2d5xjNi
TLSH
T1C9D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9077562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 caf963e7a33f79a7b42561aba3049a99f18a8fa8bf7a38077ced10cc6e39fc29
MD5 4b9523a56e9b9e2a822cff265e4e78cf
SHA1 dec773e7814a2ab53eafd9293a0419d8a5d46ef4
SHA512 fc0a66598b11fe2cd11483d6abb02fa730fdb66a390bb9549a0ec49135edda69ca89ebb1e38330f4a9fab76b1119cfa468cf63be94a76eb7f16438d15ad9ba2f
SSDEEP 49152:M1hpsNoJpF1A6BU44CwH7R4xt3rtgiomvJi:MmifPkRMxjNi
TLSH
T16CB5BE13F2D900E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BAE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5b910c9d51527b784b7cfd97d0e22fd3d8e581e84448e1b1c52b0cc1faa9a0a6
MD5 98fe6be1eba262eb1295c75140ec1b74
SHA1 72655c7717463a6ab4bcd92c6ef25eee4bd10a35
SHA512 4f5130dad022ce2d9b37b0e8b107d0d6725313e4ad3b85267847dc7bbce0017414e601293483df25b7bb24a6d6df9c73c1777f2ffacaf7a535a921adababc092
SSDEEP 49152:7SuZQIY0Be2KNRVtOnks6NMHq+3rtgiomvJi:p5dKvi61+xjNi
TLSH
T125C5BE03F2E940E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4ad587db8255f3344e34ecfbf1d8c0d9d60f6e5718d4253e3c5246057d124ffb
MD5 56effacc66c5090d8b017a8cdf38a893
SHA1 95638c1cb5d9df6e4bc9c3e3a8a7e3f9bb5e25a4
SHA512 4c47b99eda766de80a96ed714155fa6789672de065d0bde4e9c2f66224943eadfb75abcec475886eba1f4a83cb830ed35d6c67203ae96e81340461117081479a
SSDEEP 49152:JhtSn8EApI0figXgiDn0AP5wp3rtgiomvJi:4X2iyphQxjNi
TLSH
T19495BE13F2D900E8D05ED178C7568632EA72BC150B35AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ca16d12c7bebcf5fd0a7ec104fabedb4930c8e55d2670b884c8b7c3e9584183f
MD5 f8ff02345d888229794eec37d1a2e288
SHA1 fc77fe808cc7c4fdebd6243d4fe02c8b9555b39d
SHA512 03441b1e2d310c5e03c6d736fc65ba513cacfa5df7ea66582ac75192ff1e9aef2ce46ea963b9d294eb4073b7352ee51ebcec28560212381e5aad44be9d1a6cb5
SSDEEP 12288:2wDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:2qdZjHhQ6giafmvJW5
TLSH
T1E745234BE45790FCD35191784227F5DE83BAECD5EE810B076FAE7C8115BB0A83D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 53e9dc7356b39a9206c0a2807260c24a0e67c8674b40b4bcbfd415d9a421a1b5
MD5 3eb7b42fe736c70392cf710af31b0df8
SHA1 d04833ebe6d5c5da71bb90e8f0f667ce14cc4ff6
SHA512 a1f73bcbdbbab1f831d6341d003f6ce4bd368caf69d0818ade4818b66b6feba2f50525626a45e60a763f6224595e451ef8886e364107378c72f8ab43a5e33f73
SSDEEP 12288:6HDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:6jdZjHhQ6giafmvJW5
TLSH
T1D945234BE45790FCD35191784227F1DE83BAEDD5AE810B076FBE7C8115BB0A83D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 42bf150fc9e5fc4e798b036eb361931ad25cc612ba3f258ce1006c2abfa34981
MD5 378bd5d1d657147fd9e5424af4b4dd59
SHA1 5e22985670d984936ec4d82af72c255b4ef4f022
SHA512 66427cdc0dc9b7207b02580e578640940deb419911bcabf8307951b6960fc473a3f04a70b7b6c863b41311c996090008933362887f240b823f6d4c8e9c804299
SSDEEP 12288:gJDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:g1dZjHhQ6giafmvJW5
TLSH
T14E45234BD45790FCD35191784227F1DE83BADCD5AE810B07AFEE7C8115BB0A83D4688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 b1de0f6ae5e181618ad9a3416bc801aa81842325a1a40e95b2daf1025b196beb
MD5 39f2dd347f00c441e296b363fdba630a
SHA1 952302e2e642b13823d4fc52266835b353107d88
SHA512 e9aa5e7410906e4770be75752add17d989d7968197209d793c5720cdd8b64300ac502a4fe23818f86204611bac3e696fdee9d42358ef0f7d68d89c9fbecac931
SSDEEP 12288:OV6Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:XdZjHhQ6giafmvJW5
TLSH
T14045234BA66750E8D2A2D1388632F19AD3F6FCD4AF610B0F9F653C811DB62E43D05D86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7f9e0172fa2ecae383a80589453f9bcfe24f9ee0428237ace35d0da88dc43376
MD5 334567720d5c53ad4e967ef2a363f3c8
SHA1 afbf69dbd6e3d09113b845fb168b3b8ec0d8d180
SHA512 95573697de8a373574ad7c2bd1d532308fd133397d9c2f791b4e42c40022a862ca0799589660882f65495008623ae2208563c63e52a370dbaa5c6ab550e4cb68
SSDEEP 12288:ACDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:AEdZjHhQ6giafmvJW5
TLSH
T1AC45234BE45790FCD35191784227F1DE83BADDD5AE810B076FEE7C8115BB0A43D4A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ab1bfebec8d70e55e7467ca0cf5728e483894cf96407622b5f7f2be815609eae
MD5 79cfda198a924ab37fb1dafe2e7c10c8
SHA1 a399d44a84d4c6de102f0cc69167e2a76ffe7f54
SHA512 11ce6af1f132e4fd58fe1576169b00acdc92cd40654282cd7c0f0d479700a50c11c683952f9e1d43702dd45a3cb8784d3a8fc04c60bae4aa2044e9f4916bf6f5
SSDEEP 12288:IDDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:IfdZjHhQ6giafmvJW5
TLSH
T1B545234BE45790FCD35191384227F1DE83BAEDD5AE810B076FAE7C8115BB0A43D4A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f3866251b416887cd3b998bc89b322310b5bfa4e8ff5f6caca4aafbe8e740b12
MD5 bd75b35535040574e06447a6fb02cba1
SHA1 f818c0bdba0702eb02afea1bed10404b8f99985b
SHA512 da9ba9f3af8b26c6a24b1fb48688be464b18d2bbf59a809ef6ffd5dbfb2f0b94f4f38f61c3b8707466339ba226b61a6a78eb9da98f952b5b49451aae344c3c7c
SSDEEP 12288:MvDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:MbdZjHhQ6giafmvJW5
TLSH
T12D45234BD45790FCD35191784226F1DE83BAEDD5AE810B07AFBE7CC125BB0A4394688A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 356199e23ba75a1985c0d7cfaf9e11d445749638e52de4b8dfe648e04080cb52
MD5 3493c09134345bfc771dcfd854448d49
SHA1 058a2e58340f02fbccfde7b2d21f35e3d33d4d29
SHA512 9ab830bfca1d6f522f2fa5ecb87b495b591e0acc8fc04659d679e08334cfcb6a986f01e49356a4e48f818e8c997db79e5cd590a609fad6a243a858ce9ef9b1c2
SSDEEP 12288:HiZwbczzFEoS2cPvynDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:CZMMzFVSODdZjHhQ6giafmvJW5
TLSH
T121650295B35018F8ED63813EC9259906D2B2BC590B60C61F17F43A675F733A01D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 158ee2358caf9f906d60955750c4a84e2c4a9eb0881ede72c97f4c2bf94a2b55
MD5 4ca1c374524cb71e44e2fce46f121df9
SHA1 e7d3925b2847949f4f3db03437c81fba9cea159e
SHA512 403208e7535ca54917e1fbaa7b8f27ed40ace1a475b9ec3a2d2d3e1309cf447ad00dc1f9514b79a99ebcbb60144dd1b14949b2f256ba171e9f04793fd6c182c8
SSDEEP 12288:90Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:9udZjHhQ6giafmvJW5
TLSH
T18E45234FD45790FCD35191784227F5DE83B9ECD5AE810B07AFAE7C8115BB0A83D4A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 36a2c1c4ab4465850d560ef81721231739e9639fd55d099cc9425bdfdb3eb794
MD5 8e206607dacc8c73d93ccf9448456c18
SHA1 795b3c60d60f6ecd8c5c30f496c211c6df0e3c1d
SHA512 5c4ded56e24473cf38ce2a042fa949608c11bbeb1c531df64a0e29d4fd24e2752bcee41fe281a8e6c512ae4cf0e09c59b936976a8eac585f3fc87d206b0a627c
SSDEEP 12288:eIDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:eydZjHhQ6giafmvJW5
TLSH
T1E345234FE45790FCD35191384226F1DE83B9EDC5AE810B076FAE7C8125BF0A4394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 83819688e0cce4b0fc65eddc92b95d85cecaae95f1adffc091da52661e9a47ba
MD5 88a3f75872f9649b0459a4259e649ae8
SHA1 103a56295efb71ccff91a7847c65529b90f1f01d
SHA512 0a3f36a91089b4f6187d19d3a67ca38c826c409d1fc1bebb7adf638d2d5b756cef8ee343b5fd9adb009a1d57b75a42c46107bacf27928e190d01f72aee13c201
SSDEEP 12288:+yPz5L87Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:jzyndZjHhQ6giafmvJW5
TLSH
T13A55020773A230FCD1769238C9626A46F376BC714B604F5F17A41A761E372E06E2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b43a11055b54fdcb3f48a681e2bdc15ef0e16703d8e1eb69deb7adf0f5496290
MD5 5bde31b555d679367438d6f2388067b7
SHA1 c37b5ce7c839b01294e22106205431e5d8a069a5
SHA512 9027cfa80e5441c05bfd706f012478ed6dba69849f61abc82bfa2bb67aecacbcd0f67d2a5297383be95268d2073745c8ef78f565fc02f160f40d0c275241f3cd
SSDEEP 12288:K0Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:KudZjHhQ6giafmvJW5
TLSH
T10B45234FD45790FCD35191784227F5DE83B9ECD5AE810B07AFEE7C8115BB0A8394A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 803bbed99e13434a47f88a16a49b2daa9e5788e20fc5007948a1979b69f83f30
MD5 d2ea001ca35d004f67af1ea3ad5368d7
SHA1 aa850eaf2854f91c35439a024f8851f516ed2518
SHA512 233c757ee50771c21e2dfc517f9193ab4910c01c32bdfdd2ea24d33b3e8d6e2da5d809264f12089da8762772af3882cb084cecba0682b646361429f91a6fb056
SSDEEP 12288:S0Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:SudZjHhQ6giafmvJW5
TLSH
T11945234FE45750FCD35191784227F5DE83B9ECD5AE810B07AFAE7C8115BB0A83D4A88A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 41b2dccb7f2e501ecdbb68f537f50d2a160790177e0ccaa487906102e1614794
MD5 1172a06e9e2fe1d512fe92e788458f35
SHA1 20bfc9d0d39fd75f122a3ae8b94800bd52c432a6
SHA512 553e4e629d7ada7801f753cb9ff0bd38482c723cc252f6330c916b10b2b6241e8ddd1c5c3cbef2f40b6b7ff2e704f92b7555ce53e3d83dd748610009e66cfcaa
SSDEEP 12288:cyPz5L87Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:FzyndZjHhQ6giafmvJW5
TLSH
T13155020773A230FCD1769138C9626A46F376BC714B604F5F17A41A762E372E06E2EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 e0df30d608913136c820df70fd510c5399d87ea8a327d40fc140f9a1fa2b5493
MD5 d2fef0bcdcc455ad62ea89a7a6876010
SHA1 bc2b420d77438dab344d3aecd9fa24e8fca49efa
SHA512 1621962b07dfc57c55512a753fb01077cd4ab2bb76d38e63a730bbef072f4370ee337b40e6a15d86fd666856b8225a90fcd64e9df2ff094967f1d012ead96297
SSDEEP 24576:vcP4mcvIjkGOxhKP2l71SNKbrh/8KBmdZjHhQ6giafmvJW5:kP4m4IpOO67N8K43rtgiomvJi
TLSH
T14465AE2DABDC0096D0BB917885658A4AFAB1742A1F3286CB1160933D3F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a148bf42d732c0de45e84d195863313b99c2bf1d72901e54d275fd00464b5e84
MD5 b501c00ec6a1a7cbbcd3936d58a44437
SHA1 45a8246232bc96928ae830994230f8fe7454c762
SHA512 70bd5f9f52ea24f3746cd515d582fba24753d5937e4b20838f43079deead96dbde364db3cd7001e97d9154fef8ae891a49e91c44346b91d867ea8ff3667a84a9
SSDEEP 12288:+GsfEDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:i+dZjHhQ6giafmvJW5
TLSH
T1AA55010AD29801E8C16E6139C7169645F3737CA58BE183CB57D0F97E1F7A2D06DEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 38318eed0d85bfe71bd9bc24060dc0e3294b9c47a0af2185d1fe3df75a046207
MD5 94e6e532f1ebc780bcde59d55a4f3325
SHA1 591cc6e7bc0394aee0f124e288f2be9012d56ac8
SHA512 9e44d348abb4ef5382c8451cfd63a73a631de503d96816038d187d706c95411bd4ec71b777ce91934f528b8a9fc608e709596da55e96c6dd94ace7625131512e
SSDEEP 12288:0kDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:0edZjHhQ6giafmvJW5
TLSH
T12345234BD25A90ADE3B2A2340626F179537FFDE49F500A0BBF997DC115BA0E43D4680B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 3fc8148316fdb03b4910b4bea211fd3a4b0f96ed8bcc32729e19d7453aaf878a
MD5 a584935cb1dbe5f43a45be9225e5607a
SHA1 cf6335c6a4d8180af48bb5b17248e046418f3473
SHA512 51572825c2a9831121261accac7b587bf886744ae1b4d0dc1f2fe0ca52497b50b364fbe330428814ee7edba8f4a1085bff5e861b52019700996a9310f0dfc678
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQE3rtgiomvJi:Pa0hNYG4JwvxjNi
TLSH
T19E859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7be3abf98526b72fcf7f8dc66b58e0883c59a03a03e5f6f847d6d62e867c4a52
MD5 a719eabe0384d2325e5de2a9f4e5bd10
SHA1 9df0670bfdeb4f49417b816ac1f76d2681eb3239
SHA512 2df5e485a8f27cdc40a2e89f23ddf14137d17cfedc3734d355f4c173dc97118d6f0dda947aacfff7af3e837b39435182b05aa495d28ee78d1e89a5d5dd199a10
SSDEEP 12288:4hbHjfXXDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:4hbHjPzdZjHhQ6giafmvJW5
TLSH
T13655126E16AD20E8F271E17C8652954AC371FCA51B1143DF27D195BA0F3BAE42C39F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 dd78347e38ec038f6e2dcbd58301a69bc85c2ddbd8c62775c7a3f737618a0977
MD5 5f283b2969591dcf65f44b20ed0fe934
SHA1 e4a7595cf8f0afd16491656e2df845d9ad66d64a
SHA512 ddef29dbbc22f8bf580634d6470ccb2455ba8aebcc217bdee9c9f231b6e170b712db83c94e9856d192b5dce974e37b9713333e0ffce81edc75a8f1290060c775
SSDEEP 24576:G3YgnJcRTk4yti+R5dpR/LdZjHhQ6giafmvJW5:GIgnaTk46ppR/L3rtgiomvJi
TLSH
T1EC45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 c8fe10b45ce88b30f6f81403c151c4fa52aca5c913b0149bc30bce1fa52c20ab
MD5 61a002cfe3f07903c2655594eb9725e9
SHA1 f1d297f2a3f4922953ad8b8816180874562ab9cd
SHA512 b5dd8fd9f176a2a624ba39f4680d7670b7d93237d47e9e2722c89bfbbc88e8c1eb6c9ffd208c2e566e2eb7706b6dffaa9efcbdf243bfa944894dd112306a24a5
SSDEEP 12288:r4Dtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:ridZjHhQ6giafmvJW5
TLSH
T10745234BD117A0ACD3A1A1780227F1AE53B9EDD09F510B476EBA7CC115BB0E83D56887
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 80f39ad5d675b2b52915ee0bfe85f2b6c361addcc66e80f369220735e2310a23
MD5 d26ca6e65c2d8c4564aa587fd6e02980
SHA1 f295710f8958d206b62eee00e884d1cd519cd150
SHA512 0e7e3a404e8dbf907e504cf95bf69c2e5641e1ea916cfb68498db73998a1fb28ab67cf8c46e2f02e22bbbc8b4551845d97610cb6a5cbecf5ba08361580a559ee
SSDEEP 12288:AObvA4LWOsvAYFTdDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:9rL3UTpdZjHhQ6giafmvJW5
TLSH
T1C9750149E7A500F8E967D13CC9629A16D3B2B89D0760E7DF07A84E951F233E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 95d457e2e1cc69452297c0e48aaa34572c4d50b67d841fd673c9f80341a63bc6
MD5 e56759d08ebc1577044efdfbf0b1a93f
SHA1 24dccd5c1cc245468c511a9de68cc4c23e7d2e61
SHA512 c62744e13a9df13477a571a995e0143418e718094024f5aa5dd6360ca09388acf471f627865edf5ba76b36ce029c03f4fc10d2b3af30789410d46f729110c512
SSDEEP 12288:XpFtYOxDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:COtdZjHhQ6giafmvJW5
TLSH
T17755021E36ED10E8D175A13C8653924DD372BCA50B1207DF07E095AE1FA7AF87C3AA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b9f924b26350faa7e55d5c6c70d369d28648c849d353f2bbf6d2a72033de1944
MD5 319669bd03fe643efb77dd81a3ded19e
SHA1 cc9e5846cec1b3188461c997c5acf0051cc017fa
SHA512 6fca2d689b8996d17f803f32d92efa71e38708cec2f43c52d401bf344ef2e39f6594f6cb69945840a5a1a371a458245a15b653db12c35035fed6c2f3ff74f603
SSDEEP 24576:P7NM9YmZqmWMUkPjZM48Mv6bEhsudZjHhQ6giafmvJW5:P7cBWMpPjN8DbEhT3rtgiomvJi
TLSH
T13B65AE2E6BAC81E5D577D13DC9A28205F2F2B4611B318ACF1162833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 851e2afa1ecc2d857f375e158999edda419232b2eb98e6f135536ef93303f5c0
MD5 ae8597a425d2211b88c348f4dcbfd789
SHA1 5565c70fc868dee744108cd675b21eee33417847
SHA512 5f76e4ca6cc64816661521d24ece94fceb7e721f6d705e9c0c92773b7af7c54a23e1435e1f5a3fdff6fabcf72fbb5d13161ec212be27eedc2d2878f8befce07e
SSDEEP 24576:wW6BApg2YuyuNDYTabvcRvNYf8km1gdZjHhQ6giafmvJW5:wF2YuHNETovcvNYf8kmO3rtgiomvJi
TLSH
T1B0858E2A27ED80A4E0BBD27D45B7D146FAB2B8511B3056CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4bf7b0b746a22a242d61adbeebb636e02c140a08bd37b8e56ada69f8c012a245
MD5 2784037953279cfcae64fe150c264587
SHA1 b1eb397fa97f82d202ecfd225147dcfa25cb0517
SHA512 fdcaea8d78e8d773bd2912615952634a15aaac1a79cb60b230161a14cceacbff028465c3ddadd0f485154117a5ba99850a06bab2fa3db16a7fbd9d6cf63e1d20
SSDEEP 24576:gAFs06+OmlfQNXEbToxdZjHhQ6giafmvJW5:1Fs060lcXuk3rtgiomvJi
TLSH
T16E65AF2F62AC00D5D07ED17D8A97C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 6a30defc25c032f521eaa072514501bd8b60b6883bd2120c60453398f186ca98
MD5 bc4dd2a41db76d11090219b8ac74166a
SHA1 de420189552f876a9c9e672f9c7d6ad69ae0918c
SHA512 589c8ca1bc1682679b8820b28729477f61b2e720c092ec902e256ca044af37a599f1a19baf7b35878bacc74430b611e5c2d269dd00820dd70b223bbdc7f9eea7
SSDEEP 12288:9CJnJ5D3VkrlzxUDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:UJnJ5D3WtkdZjHhQ6giafmvJW5
TLSH
T16E75D02DD2A810E8D4B7C274815A6756FF72387D2F226AC728B4D5353F12EE06979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 72cd33aa8e8e03d2acb266f7f9aa91a82e726d0b492d5a94dd93c2b0ecd0da53
MD5 6e59c235d5f89128fcd138eabe889ae2
SHA1 314e38f476ed7891bdaf2ade769068f27a1727ed
SHA512 5414964effe933c990c7c3c2fd8171c26babf5ece65716f7e4b4133309398daddfef82757074d371ecee2c6ffadfd28783e0b3bb54eb67669dffdaf2a294993d
SSDEEP 24576:SEPohm6/7IIXdwcXrif7qQncjlP65i3VuLdZjHhQ6giafmvJW5:lo06DIKdwc+eQnSt65aVq3rtgiomvJi
TLSH
T1C8956C06B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 2344997efbc58358d72309b0c5cee849e8d691fdc0a600bc3c8b93438a152fc5
MD5 61625c219da98400a08d0b88764f7ae9
SHA1 9be65391ff867a1fc63ce7efa4d0997893979a24
SHA512 5538cfbb3b8df027e8ba5d5e961dc09b4a8f7c6c5088841fe8ec024f80ee0cade24bf974c2d600c42a1c5f0ce13c5aa0d18ac86b5eaabe248898f6f04fddfe69
SSDEEP 12288:XEP3RrGDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:crodZjHhQ6giafmvJW5
TLSH
T11555125E679D70E8D126A03C8161C249C3B2F8B02F521BEF1AE1D97E4E775E82D39E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3b40d29fac962726830e0437f40f1f9d43a82f89f20aaabd59629a314770bc39
MD5 6662eda1b458c8bb108f6136a9d25ce5
SHA1 deaa8ac0479f2152d2ed627f88dd42403af8ee86
SHA512 3f9bb9d04f58c1876c3017dd333b7ce93ce6e08d1c5d81de60eb19633efb1406a22fffb126f85f13746f2d2889df81ecf883f8184260c99deb5e0bd857eee7bc
SSDEEP 12288:hjkyHDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:hIyjdZjHhQ6giafmvJW5
TLSH
T1345512096398A0D8E2B642388A7391958775FCA05F2107DF66D0FE2E6E772E47C35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 34df1083b4467f358b6274850617a66ad3750c8360a1ea2eaebea2dfb6d9cd86
MD5 8840987cbc7ba5b7a8431d9417b5a65c
SHA1 efda7118e1437b6e89986ce053faae2c045b2b37
SHA512 df370ea3927859f98531bbee5bbd0a8042d7e3ae54755beff1fed4d7e3dc8a28a9b88d2e492978dd4137ff5fb9f594c460892f15b804ab08f49079ab61a93e42
SSDEEP 12288:9FhDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:jddZjHhQ6giafmvJW5
TLSH
T19645230E9117B0FCD36291784236F59A43B5FCE46F410A5F2EF9BCA14ABB0E43956C86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 78c3cef04785d49bef207b253f1b11dd5272e6720bd8ea852992526eeb2afaa4
MD5 f09620f83defe6c0ee554fe0d7f880c0
SHA1 9dc02b03e4ac27e2d3be211e2d35fd5d710c9d2e
SHA512 946a2d8d4e7e36ba9da3ff6e75ceb6adbb832ded17abce1e1a9d1a1b2189181d91ec5c91d401d6f5bcdd1e410327f73e1706065d86f6dd43a4919fc6ceac6e8d
SSDEEP 12288:mLQZb3C97GYnZMv5zBcKY97MD3MDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:AQ9MxZKdcz97w32dZjHhQ6giafmvJW5
TLSH
T148558C2DABE9059AE177D27995A250C3A673B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f96449e01f90867b6b86162ff8130a4a2d3e0871f9b8b0d05efaf9cd8d362984
MD5 b3886bc82392cd52c52e613895bc5dad
SHA1 92224f1d910267a5db49078039627411a1657cea
SHA512 85adef9528f6d1838ee44e5b6a6a114493dd1c034f1c7937da557767182c530fb8d6fba5f61f4a36fdc27eacea5ccd6671f4ab82a39de77fc4d5bec2f96ce0c7
SSDEEP 12288:+yoKo2HRple9pLDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:+yocxAp3dZjHhQ6giafmvJW5
TLSH
T17A65E00FBB6A40E2E172813C89868745E7B3B4705F6217CB6691C73D4E679E87D38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9875c7b0d520c1daa651faf6ab14e521c7b5bcb2a47f3f65af55e76740d5cadd
MD5 140ef571bed71b8c95bcc25d148d2952
SHA1 e89a3d4ef4216e7c65f88445b5d8c9c18d4c3acd
SHA512 f54e33010888567300e3b09f980012869c755c5ca148a8fbb2adc357fbfea745f67a84fc3f061e1b11cd3aaf47dfbeda398f60e0ad222206e7af40e6865cd42c
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK33rtgiomvJi:V0zuNI7xjNi
TLSH
T180A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 32f76035c34594273e6383afb7bb32f751448c46cd0570ceb8cd854937f90acc
MD5 d233fb1c1f023de251fab449467c53cd
SHA1 71f92c1c6a564ccdaf0b96772cf4429817235959
SHA512 4b2cf5166dff22c27f3d95c737652765e58d34e7008aa84cb71a2e34b696ca2ed01d5b720506698251194ff784e9bc35611c2e012b9414a52e9a7787671dec3d
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYsjMqbodZjHhQ6giafmvJW5:OTDxR+N5YzTujMN3rtgiomvJi
TLSH
T13655B02EA7F915E9D1BEC5788A23C502FB727861073193CB42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 89a7fef69520bf6a315ed2a253e5b78b83749df8f469d1a807ea6ee2878c290d
MD5 e0722d5d6e83eda3afefab2aa85b9324
SHA1 c2825493bfd918d28b9e58c3a99e1471ff6d8dce
SHA512 77d78c62789e3e8266e35901157e050c473f787ebad4a10c980f9ffa10100d385f836571246b708452da340408a8f068eedd0b58df15304ec33b828a95079546
SSDEEP 24576:iTMdOz0FFS+hmSLMdZjHhQ6giafmvJW5:u0K+hmSLM3rtgiomvJi
TLSH
T1D975F13EA36D14E8E57BC17C9653D906E67278A1032166DB06E0C1B93F5BEE43939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 32d8033361cf11063b046ee662fc563e088fb9f6d653587f09b82f295e414041
MD5 5cdb6834e95f5e47c1a7c54cb5d4434a
SHA1 156734d689ec0f4e0582ec6b7510f54da2f9547d
SHA512 dce13b7a433c99d9631e250863f2b89cf2ed2acb146d7ed59070a79802a529969febc63ad3bcd8599baf2223e6337c833596261421ae8628ca296c3ead95555f
SSDEEP 12288:047dDtm1aUiPrfUQhQ67sv7mfYTpKk2nneoJcR5:TpdZjHhQ6giafmvJW5
TLSH
T1EB55120E63E930E8E17291388636915A8371FCB51B510BEF3AE4EDB64F771D46939B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-174-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/752-180-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/752-341-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/784-47-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/784-354-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/784-53-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1060-184-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1060-190-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1060-193-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1060-195-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1136-356-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1136-90-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1136-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1684-456-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-467-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-458-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-455-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-454-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-460-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-453-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-463-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-464-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-457-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-465-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-474-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-468-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-462-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-459-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-475-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-466-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/1684-461-0x00000231B82E0000-0x00000231B82F0000-memory.dmp

Download

memory/2044-164-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2044-340-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2044-170-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2460-233-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2460-227-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/2460-345-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2460-470-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2656-43-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/2656-37-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/2656-93-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/2656-92-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2672-335-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3020-203-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3020-197-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/3020-342-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3528-343-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3528-207-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3528-213-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3672-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3672-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3672-353-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3856-337-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3856-447-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3856-445-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3856-138-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4064-469-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4064-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4064-334-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4064-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4168-286-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/4168-238-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4168-250-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/4168-346-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4168-266-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/4168-244-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4168-471-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4348-339-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4348-153-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4348-159-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4452-8-0x0000000000400000-0x000000000061D000-memory.dmp

Download

memory/4452-425-0x0000000000400000-0x000000000061D000-memory.dmp

Download

memory/4452-9-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4452-0-0x0000000002240000-0x00000000022A7000-memory.dmp

Download

memory/4528-68-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4528-74-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4528-78-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4528-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4580-355-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4580-113-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4580-107-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4588-33-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4588-66-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4588-27-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4656-338-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4656-149-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/4728-452-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4728-22-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4728-21-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4728-13-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4872-128-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4872-122-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4872-336-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4900-344-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4900-217-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4900-223-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download