5ee5c27e606f3a71f9ba44a51ca6d343d9f6a7717e97fec100ab95e813a755e7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 08:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Size 1.5MB
Sample260925-j664katarg
SHA256 5ee5c27e606f3a71f9ba44a51ca6d343d9f6a7717e97fec100ab95e813a755e7
MD5 66154011261503877d9f7f773722a5cb
SHA1 eaefa920b9940ee53ca103befda06982356ec9da
SHA512 8ca573c55540925ec9606cb579f5678790cb05399f7258f5c153eac73786382f6ca2122dba259872e5d4d9bdc6bd1dc6e7ef5e9b63f2583771642e45140cb50d
SSDEEP 12288:F93G6vHzOASubviBNDYa3DK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:FVGGTWBZzMPrVmZeHgCFyqXHH
TLSH
T16E75122176C0C4B2F6A3193549B499710A7EFE301FB0899F7794276BAE306D24D39B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4048	alg.exe
2880	DiagnosticsHub.StandardCollector.Service.exe
2040	fxssvc.exe
2352	elevation_service.exe
3428	elevation_service.exe
4928	maintenanceservice.exe
2280	msdtc.exe
1784	OSE.EXE
5040	PerceptionSimulationService.exe
2776	perfhost.exe
3208	locator.exe
2840	SensorDataService.exe
4688	snmptrap.exe
2660	spectrum.exe
3508	ssh-agent.exe
3240	TieringEngineService.exe
1776	AgentService.exe
1800	vds.exe
3304	vssvc.exe
936	wbengine.exe
3308	WmiApSrv.exe
1392	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a7ec0de3a26b1277.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaw.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b5b0074c64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036bb9a72c64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e5a1f74c64cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056e28272c64cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af44a472c64cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004bd69973c64cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeAuditPrivilege	2040	fxssvc.exe
Token: SeRestorePrivilege	3240	TieringEngineService.exe
Token: SeManageVolumePrivilege	3240	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1776	AgentService.exe
Token: SeBackupPrivilege	3304	vssvc.exe
Token: SeRestorePrivilege	3304	vssvc.exe
Token: SeAuditPrivilege	3304	vssvc.exe
Token: SeBackupPrivilege	936	wbengine.exe
Token: SeRestorePrivilege	936	wbengine.exe
Token: SeSecurityPrivilege	936	wbengine.exe
Token: 33	1392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1392	SearchIndexer.exe
Token: SeDebugPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	1200	2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	4048	alg.exe
Token: SeDebugPrivilege	4048	alg.exe
Token: SeDebugPrivilege	4048	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3552	1392	SearchIndexer.exe	125
PID 1392 wrote to memory of 648	1392	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_66154011261503877d9f7f773722a5cb_amadey_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3612

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2840

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2660

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3508

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3552
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6ec4e9315ff64442c07a72f9eb2a65db06efed16d81dfa577b91d32c2d23bc3
MD5 0a1443ec749997e6b350b51b981a135a
SHA1 f5cec60eac1b3185413476a99020a1d992c0ce86
SHA512 bd59860707e3473e720996e5fda0ed832d80a5ec78eeee6bf35a564a40dfff6666f82d40cc976b47dbc0b7f37fd4eb9677aa007c57a4915febefec348b03e8d0
SSDEEP 49152:Hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnVgweACFzXHH:13q60jBIgrACFDHH
TLSH
T1B4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e764f5f33a5ed4637bc748659c5a2b520e890d2b6c3c10ca9c0801ea8c0b672a
MD5 cd8fd5626672a3b6da28918559c0742b
SHA1 84bd139552f7f5e1b8226b63631a1abd8046e531
SHA512 1088abfb50a13528574177601a58b7f851bbe2b8b3c7f361f6c8f1b9fcdb2a1b8ae0e6da6a9cca9c65cdca6a2e3ea1470072c9c95accf4abef42a585b29e9624
SSDEEP 12288:o1XLsswWkxy2lRq2czAsK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:OXYfDtczAsMPrVmZeHgCFyqXHH
TLSH
T1EA75012877D009F9FE67823DC9A28402D673BC5047A0D78B07A496666F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e1bcdc4e31d9d235440e0c4c09e68abdfb604eeacb234138f1cba3eb0f2ada26
MD5 2f775d4e3f497b14b82ba804240d782c
SHA1 ead73e8af8eb5696cb1423f0712123e5d0b6cda5
SHA512 77628fdef6b1087956d26afe25a43643220120799d080f9a8e6f58bf9458031c40861da9beddc74ea140d01cb796b250f4b185f687d89617fae8c26c73aef845
SSDEEP 12288:CXZNYVLeyUji0h90ZD0wxpGZIVuNrHsNK6236urhHbmZeHTU0REgl/jrWCD5aZ1+:G0Le5ji0hmxKrMNMPrVmZeHgCFyqXHH
TLSH
T131959E16F6748735D073C0B9C5D2A68AE97230815B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 040d5d55ddc78e33239d7d17e72f8831b683e2640799c7854c98cf1c98eff2ca
MD5 e153f618c3ff423838060712163700f4
SHA1 c597d53de9e6a7d9c4300e7721d4a1d4fd0bd7ce
SHA512 7a8380fa688dac5313bdca5e9d8fba9b5f90c8777103ddca8f5351b253328a6baa32106e98f5d595daed1dd961d0926be556612815e5b6b58351f6591c856be7
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWr6q8wyufMPrVmZeHgCFyqXHH:w/ezSC6vUzPviHjy2gweACFzXHH
TLSH
T1AB755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20bd3a9f335718049975f470783c003ecbb51ee37bc0bdc082449da7a4f8ecfe
MD5 50693fd1520421e58f55008894ac8ea5
SHA1 f6b8a28bde5322555cda65cb98792071b0477390
SHA512 2580eed4977851ea1a57ce160d3a030a81c0a4878683c7f6df36566fbfc44cb8733ab2e4e05dc0b531df9a312bf7f35db62c28f683d7fedef946ed7b73d809eb
SSDEEP 12288:tVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98YK6236urhHbmZeHTU0REgl/jrWI:tVbqPb88hv/l+bYMPrVmZeHgCFyqXHH
TLSH
T16F559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9e72cc7e96ad6d2f7c61622057fc46fb7e2059456820da299845f6789c3e5a2a
MD5 3616f57e45f5d102a32ede9e2cb1baa2
SHA1 9d1b4f235a95078cbd5861ef30297519cde6bd3a
SHA512 d721abcca7648dbce22172bf763256ef90fd8a05ea044cedf3d2b059cc5134d7243f212c55a917cb648f56efd936bfb837b463dcd21679a3794acc0db88052b6
SSDEEP 12288:D/pK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:D/pMPrVmZeHgCFyqXHH
TLSH
T10D652355ABC0EFF4F79A553B855A100206E7EE404EF0C1186E64B3C7F635AE2C8E6927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 d8c03d739db6646efd165901ebcec230a30b3791b427ec0e6d7faa3c2c947312
MD5 c105c6ef58dac7a691f63722e72a9f29
SHA1 a22263a42e8c03d468b66dff3bcbd6b083620f2b
SHA512 1a97a450414d956ddfd3b22f3d6225609783a6c8c0161a1fa67d1f1d7d2f51e6248d8e95ff68ba2da81e88f93f0d31d11dc5915fee7ada3c51e391e168386958
SSDEEP 12288:eeBNUbTVO86UQK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:eJIUQMPrVmZeHgCFyqXHH
TLSH
T12675CF3BEE68FCE2D27A8DB95691860097B278304F6193CBD174834EDE235E14D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0426ff42c76276de2a3cfb1bd9fd75691e40bed1f68ca634cf7a95aaaa4c7125
MD5 1acf5b92bc7054ccab702f22db88b86d
SHA1 a8dcb790507c6deb094b74dd8122119ff95287ba
SHA512 f720fa6da957f673eadfd7977d98c45ecaa656b764c87c395162afc5489dc39e7a89d9924994ae0a4478d895c9fd24493bc467ef47fbf76716252ea2ada28ed5
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THN:7QvGAdlCEL8c/RRNw5CvgrACFDHH
TLSH
T160267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 6bbe9b1bd9100bf0a500b09433595326e6d694f23f4d7db5a3457edee26d1476
MD5 e2d31a2a4481cd732a351f4712b308a6
SHA1 23e4a6e508e4e18908c1becce97c93091548522c
SHA512 d7bcefb841dc81c8bde1b1f0df30fa21eb46146f6ba55d74cfd46a8d4dc21197bcad24399554c906fa3397c4170e8d2c973763e4e5889e8b17c0f54f3a80c15f
SSDEEP 12288:dAwSfxL/2Dc3uDLLmt0LDQewsAjCK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbR:ObewsAjCMPrVmZeHgCFyqXHH
TLSH
T10F85E031FE70E436D77B0DB61B26C706147DB9204FA119C3E3A89A8E99306D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 12f3f3fc8d1f6061ff683742e5c357a119826c9c271b4c509f728249a0721aa0
MD5 229fdfd5a48522c0019c2078ffc0c09b
SHA1 c47002463f06eeea64f3119c6806e54a8bd03080
SHA512 572c510e2c7e00927dd4cfec93906cfa653d52c1c49d2e5269c2bbd0d72f904aaf18f9685da80cf953d4f64bc0996f9e796a33f31f54f9aff863f25b214cba67
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHNrA8DHH:NUEtQevvqc2W1cpV2RI32JB
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e6dbf8c2c8b971716ca55cb3ee64d4aa664f6d3d32a57fbab1dd578b72f1110c
MD5 82ee0d740a5205cc3c17c9c5f05012a4
SHA1 c78da7e5a7f300db0656ce61e343cd7ea89b630c
SHA512 8ad0ef034a2534f7407152ab6c287e6874d96e21d094ebf4eb30ac2b97ffd5d7007770980dce23679304274e3426acb027e4088cb24f2bb430ab8332f2e78320
SSDEEP 49152:bCbRquA/m2yL5zTfFiV+XenmE3/zigweACFzXHH:EoquVjnmTgrACFDHH
TLSH
T110D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7acd87391539c20d863af4f57ce9785c0f83a8294394a82afaf60eec349c48c2
MD5 72db6f1c6aedfd1df3fc477042b76012
SHA1 7460213b5c65118962178723dc4056087b2f3194
SHA512 26046b2c414cd6e738b17fcd6867d608594005545ec0cf51ea858ed39daf61a5202726f2b550034731d51c5c25489e77a0a883470cac128f236b2973deb06bd7
SSDEEP 24576:OAhGL2IFoiwtA5l7S53zMPrVmZeHgCFyqXHH:OAM1Foiq5jgweACFzXHH
TLSH
T19C35AD80EBF955D4F5B3AA7899B68171EA76BCA55E30C20F2160D10F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 5a3771c39a6a1b760edbdc25775af488cf9a5f2139507bf8ff6f9717103e260f
MD5 0a259721e98e76ca707621bc85a7d345
SHA1 410807b3f09ff394d5ac3e673c3dac7c3c77a315
SHA512 9f55ca226e024f87f91ef6de0d48176f55dbf232205c353b9ac84431d15612eb7f403cdc34470c8c87d00d20cdd4e4f6695086db6054b4673ba2203ae114b827
SSDEEP 12288:pmw5HEjsChNjBFgl0WDm+C/K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:kwuWOWWMPrVmZeHgCFyqXHH
TLSH
T10275F14676E41CF9FAA7813985578132E7F2BC012A61C71F1760C65BAF37361AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8e81b5c10f1b89dee84dc605246b51a26ae62af847f8e63c050742141d173038
MD5 4baddeeae767c43e1217211a916d3df5
SHA1 3cf1d8090425618807a84fce08b3caa06a4a7b6e
SHA512 1d2ef58a34477e69a2854440eefe1de7d576d8b1c908f7e92b55b4840d5c45f171300e892412235bc38ab4aacc86c34039b366cf4e036b16ab760eac5678927d
SSDEEP 12288:RLZ1IySK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:FZulMPrVmZeHgCFyqXHH
TLSH
T16565125A37D076F9F397523DC9A5050287B2B8511B7183CF1A24A29ABF33ED24D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09d1fa9e0a4032f37266ea06a002dbb9b9dc29c63008e28e610c7430378f636f
MD5 659f9e1474bac0ee1c3e8dbb3be349a6
SHA1 233f1694edbabcdbe4170f3b49b5a19bacccaa64
SHA512 1cfcb6ed6bf91f6887e39ec4da998132261c46b04b4c10a879beb3b0425a7fc7df126715ab67aebc9fba5498ff6c4964f7e66230fde69b22e7fc137fac3a4da5
SSDEEP 98304:/QRQyi36YOcPhLvw2gAf+PN3kgrACFDHH:OQyiKahX+PN7rA8DHH
TLSH
T1EC667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a2fa9e201fd1bf22a672b7ebb74f0798048c205ae6527ce5334666dc32e1a9fb
MD5 9170faf49b0f03c077fbf782ffe8d177
SHA1 8d2dc7a14c17e24c884532fbce4dcbf0bd3c37f7
SHA512 f87fd961933cfaf60d48c05942426f165825b34cd66df5a8fe03b42a514756fab027f90143cecf246a499ad954ce5e322ff3b2d582516bd1ca349474dd5e31de
SSDEEP 98304:zQRQyi36YOcPhLvw2gAf+PN3kgrACFDHH:iQyiKahX+PN7rA8DHH
TLSH
T145667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 130bcead29855f67b54ce1734356e82ceeeb12a1c8acc500e6711719a9928eb9
MD5 0d156102b4b24e964b2f95bd81e99df9
SHA1 50f9204e81f127dde93243198d446509403b11c2
SHA512 bdbf6d3bd6201130259c5207a344d32c3ecf4185c12b54da4355bc1bd7277a72bc6a063bdb1e0ee2745eb3464f056f683b9fd8906db78fffae881f23c95c1625
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0VMPrVmZeHgCFyqX:r68Qg55nhceWu7PNU3/ygweACFzXHH
TLSH
T12FB55A33B2F200A9D44DE1769F4A872196D27C758FE0E3DB851572061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e3a4f8153dcfc0531b75b1a448372bd4a0aeead4ebc338f5be6137c7b4eba90f
MD5 0b0e4462b3c3676b6526d5298881fd40
SHA1 864615a9077bb560a5b41c69dd23151666b2273d
SHA512 5f5c04c963f03dec99b6b7ef7df27f87644e98aaf9d79158c0824983efc2bc5343c9bde0312cc7d5f8173761e7d2144753d630156191386a1152b38fb17f83b5
SSDEEP 98304:fy5112gYy5azzVva69nLKnhZpgrACFDHH:SLIHjWhcrA8DHH
TLSH
T1C9168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f599aa9c78aac25846fa85addb0d53bfc9d00e4484c587c4e373b7ed2abfb263
MD5 f2fd39b8076b1fc2c56341c5db9e1886
SHA1 bc0092f953c4af78e78415db163004e15bad86fb
SHA512 09d2821890c5834dddd7f79ab00b53444071ecdf5d604b668cade65215e9d7c418c064baff2755cab36ea52848a5fd1a5b9875121f75d04d230715c03cd6d5df
SSDEEP 49152:2B+taZ3usBWOBr4tEG20bqx0z+n217aau1glcgweACFzXHH:Eu6JmUxd2dcgrACFDHH
TLSH
T1C5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 670f7e80e1fb19fe2353bad36d039e406f3fad0be5c232d270299592531e008f
MD5 bdd315892a562ec513ddd24b96764c40
SHA1 b840d8a30647ac592120265880223bd56b92c2c2
SHA512 799365f707c0dd330d75f9c05a9c28fc4d9ae7b6dc9a0e7c96984219fe752a4a19c2b86de30346e5c1e89ae16516359e82745f7b71f4aa1cdae59cc73cfbd593
SSDEEP 49152:a1hpsNoJpF1A6BU44CwH7R4xwgweACFzXHH:amifPkRTgrACFDHH
TLSH
T12BB5BE13F2D901E8D06ED17887569232EA62BC450B34A6DF0A90B7962F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 202440a7461cb4b1dd6e8709b367ff39bd80f99f434d415667599feb24a1aa97
MD5 f34e9ffca49be2c63333c657c4c7238e
SHA1 5704f6b35afb53e7324fccee446680cc40e82fd7
SHA512 aabe6de1fb658dcbec0d4649d9d0167d35a5854d8df103f549afee3ba39160893b94d49f8667362515685bdcf5de71044544d5759e906796a3302f3a71564379
SSDEEP 49152:GSuZQIY0Be2KNRVtOnks6NMHqlgweACFzXHH:I5dKvi61lgrACFDHH
TLSH
T1CDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a3a667bb5c67476180de861b6d6ea1208a0d873a0a201de9ec54bde9d0de4294
MD5 684d260db7deae63c4fcc05783e6bc3a
SHA1 dbfb8ab97f55db5886f6eb3d9e4282e2ab83fe7f
SHA512 303f4cb2bbec712de9ef1836730214d61ef4dfa13ce49e234af080b9747b1b83f82898b6ac6d8018b1c12d819eb61163aecb55f7bc1d7834e9ff88e65214f00f
SSDEEP 49152:ZhtSn8EApI0figXgiDn0AP5wsgweACFzXHH:oX2iyphXgrACFDHH
TLSH
T1E195BE13F2D901E8D05ED178C7468632EA62BC150B34A6EF0A90B7562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 872ea2e8955b3c922ca2d63b9e2046c4fc5518f90c358d91f2365f0e73923a7a
MD5 8405f6cab317f11c34c294459b650021
SHA1 93ba467a7dd87115fc755793f0a499f776481118
SHA512 09294b9b9530dd30eb3ca15cdc74004c1374b7aadaeb759dbad20c829142ea720f7bf4be58c094d159aea5dee50815c3d2c7a9021e439a4f292bf629e3528a6d
SSDEEP 12288:zhK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:zhMPrVmZeHgCFyqXHH
TLSH
T1F3652355BAD1EFF4F745457BC656100205EBEE405FF1811C7E28B287F632EE208EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 5ff3f2ac3a529ed53d2212bf66fb5577a33b6ad1ecf190dd003807e9e4ecfe37
MD5 0308f55cde621479f9a42e8d43e93481
SHA1 14b17b3b7ce9fa9bf97b527d5e7341efaae05acc
SHA512 83414d8a1628228ec0fda30003017715f8c06140b844768d534bb82d861aa1092124be5acf52ee885778949f986179422f89ad72a7ec65333bf73a79ad6c410b
SSDEEP 12288:HeK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:HeMPrVmZeHgCFyqXHH
TLSH
T18D652365BAD1EFF4F745457B8656100205E6EE406FF1811D7E28B287F332EE308DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5355c4f6f2b91c0b59a37e28c820599bd41212efb680488d01ec3c2919cb042b
MD5 6e54d819decdafd267936c682bbec1ae
SHA1 eab72fd55fad02f5e5d054e09b99e68de964f302
SHA512 1717fcd685d266087359e4888239fdfc0578f0a7d3548aade6a7c4074a9ba4d9bcb1d3273d32778014159ebe826a5c9aae61be00b23f16206faf81205ec4d6ae
SSDEEP 12288:iIK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:iIMPrVmZeHgCFyqXHH
TLSH
T195652365BAD1EFF4F745457B8216100205E7EE405FF1811D7E28B287F632EE708EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 26891147237ff26a35337d5676ff9b057466266aa64f7ef619aff9549c6295ab
MD5 f54c4bb6e5569a4cb02e0abb2c6a53eb
SHA1 e7908a0ebfed14df4cd83abb0cf7efa89a511efe
SHA512 118ffc3cf5271e8e33cf00dc74abbd6fab842321f7bbc226349e7a665c2ff595ad65a1fabe6b43b60e2bf5116342544f3e046f989ee60a2f14198f9ee5f654f8
SSDEEP 12288:FVTK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:TMPrVmZeHgCFyqXHH
TLSH
T1FD6523557BD19AE4F756923AC556000282F6FD809FB1C21F6E107287FA32BE14CB5F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e95d49366863e9768f8d36c6054f86e786bfcddfa22e9023b05b5049a62b838d
MD5 57c5ef8495552d839061592d4c12eb3a
SHA1 de036e8819f40a900c80398d5f0a19cb487382c9
SHA512 e2be5cf98258f96c00cc56e526c01fdd1b34d21173dc05de9c5550e2771ee3e3dcdab82e829e32605cf0d1a0e9a1b9d47120d5cfde5967dc0b174f4f66672406
SSDEEP 12288:9bK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:9bMPrVmZeHgCFyqXHH
TLSH
T1AB652355BAD1EFF4F745457BC606100205E7EE406FF1811D7E28B287F632EE208EA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e5bd61dcb2eb0fa23544f12f2e2ab899a31d997bbeed724b343f6a112c0c5f23
MD5 4f055400fa41f6f341d2edbe47f54ab0
SHA1 8fe540fb7570ef41813816e19a99abdd9bfdb633
SHA512 0c52ae32a13ada5d819b24737520935293e6046f4f877a6100c4cb25e365b11af80096dacc39c24acd34b0e1c3765df01bd91d8909025d1fffb4a5d247c784da
SSDEEP 12288:yaK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:yaMPrVmZeHgCFyqXHH
TLSH
T1E1652365BAD1EFF4F745457B8656100205E6EE406FF1811D7E28B287F332EE308DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5c8c093f4fc30c255d650e7f7bbfed362490ebd33251cc22fd7e9608de128ad2
MD5 63d1809e0327815cbbad4b7b42cdcad8
SHA1 64cff08eed6c29155d5bb30a8a827e104fa94c35
SHA512 053c42f6eb77a8fe651304f673ad524db3e9aa140841240c418ed7a45be6aa98c96dcb883b651a709c5f8fb317bc190b388b1c75573f679367cc97628ccc9056
SSDEEP 12288:mGK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:mGMPrVmZeHgCFyqXHH
TLSH
T1BE652365BAD1EFF4F745457B8606100205EBEE405FF1C11D7E28B287F332EE2489A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 66ad5153a4d708c2c023806af97f34905b83325c53e331f785d9d22fa5e03a36
MD5 2dfbb6a0b116c17d9d3032f55da92e7e
SHA1 14ed0b4c8162afcf89896477b7e446bca6cb76e1
SHA512 079328d05510736d5a6535fa90d6dc4214d982b4a3a1b2ca586d12cdbbf12ede402883e21c4fd1d9d0b23280e08f4571ecb428fd853fec11658cb32b1d6490ed
SSDEEP 12288:UiZwbbzzFEoS2cPvy+K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:3ZMvzFVSO+MPrVmZeHgCFyqXHH
TLSH
T11475F1A5B3901DF8ED67813EC9154806D6B2BC550BB0C61F17A43667AF337A10C3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 46905fd02dc5e4039b68381d7a8cef43a6a19dc273b713a0382538e760909879
MD5 faa2ad487bfa111383d0d9d444f2ef8d
SHA1 42868f27809a763779b939c392b59e77688b921f
SHA512 447065435de18236878b76507cf25c071892bdef002a56b630e1b829ac3bcf781754bdbd2d2d876116adf68a891351b8e85112ba13e7cf72b8a663f1fa9adc11
SSDEEP 12288:k1K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:k1MPrVmZeHgCFyqXHH
TLSH
T17A652355BAD1EFF4F745457B8206100205EAEE406FF1C11D7E28B287F632EE748DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 75e99b205d466901865500c4c703d00dc8c078fb5ef705c9fb8c98c412eb0d5b
MD5 f9306cfca404d9b0c26b381893c4989d
SHA1 7ece2c0512873e94147ed83f6e83ed38f0510add
SHA512 7df9b8560baf040900b235c1631cefafb591dbb9c63f5a9eda143dca62b94f5c44e57d1736b637d81c0fa1b2ca59e2c6c5fae04d6a0d2564a14a8c640fbd8f04
SSDEEP 12288:q5K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:q5MPrVmZeHgCFyqXHH
TLSH
T1A8652365BAD1EFF4F745457B8646100205EAEE406EF1C11D7E28B287F331EE708DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 48f77c32000ba9495c820c5d2a6df759355b8619eff5c68a4e80fa2eb0e65980
MD5 6e4bd40a3068e09e8016c1f2345d1a9b
SHA1 5963c2d27555a381bd8188cf217adefe304dc586
SHA512 ff8d821e44aec54e5e09ee4160f152a472b3df1b6dd1f912e57e120f13aeece992b251e47992146e1f04c8332de1a776ce1f255b7b714e30d93bee12aa4b42f6
SSDEEP 12288:yyPz5L8SK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:vzySMPrVmZeHgCFyqXHH
TLSH
T1E775021777A131F8E2669239C9521902E7B2BC310B708A6F1B6453B77F336E14D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 3a266b280e392d04684223f1bcc57106d26081437cadfd53d5c07ab5328aa7c9
MD5 07c5df72bae3e375da221d25fc66d113
SHA1 b4420fa92dab760b942f7d33ebee95247b97eba4
SHA512 6f4ed400be20d339985bd2a85e935fbc556e1207dd5339b56fa9190de2df1f0093dbd268e4452f416fb69142a83d9b7ab4dabbc4afd06313290dca91899733ad
SSDEEP 12288:f1K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:f1MPrVmZeHgCFyqXHH
TLSH
T182652355BAD1EFF4F745457B8606100205EAEE406FF1C11D7E28B287F632EE708DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 b4ff8619746f12a9ca5c0ffca76880d96e71d1bc1f87bd3cc2903834f8421253
MD5 5ef75632deda479a6f3901e90df0f132
SHA1 7b373b88a1c4e3fd5b27f49d66a344072ab6c0f9
SHA512 73800634a094df840e379985eb25859efbd66918db632305267fb61bd1d6761399990ffecf82e7dba727c967e2cb68ab636749b7c91aae7669bc7626d280370e
SSDEEP 12288:e1K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:e1MPrVmZeHgCFyqXHH
TLSH
T1A3652365BAD1EFF4F745457B8606100205EAEE405FF1C11D7E28B287F632EE708DA92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 1bdb01def650e04727f8291079cec56e83a87fa30b06c3490e7bd4c26bdacc37
MD5 d416f0e68e2d95896819d73093333837
SHA1 6a781eb8c8b01cc2331300de193faa69e8bfe9c9
SHA512 fd4f378769f0a425bb7ec3d146071f4f4e2bf5881997fa0dc528f48999b0292950cc57f7184d520a6fc48c3b16c93dc633f8d9b6982368bb9e9f860dc6b40d4e
SSDEEP 12288:GyPz5L8SK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:7zySMPrVmZeHgCFyqXHH
TLSH
T1EA75021777A131F8E2669239C9521902E7B2BC310B708A6F1B6453B77F336E14D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 79f83bbf95cb0777c66a1f7cd83aac669621e49473b6b5af59bfb67a50bfbafd
MD5 f7f3fe9b5e505d29395e847f093322f4
SHA1 121569bccc9a9541500521941bcd4ddbc6deb722
SHA512 cccd6bd2b56370680c26d144ddac6828304b9ed80d78a85faff23b6638b03199e77facd56459c3c2db8571326353caa5188b9f78e928d4641b26f1f1a034ad75
SSDEEP 24576:gcP4mcvIjkGOxhKP2l71SNKbrh/8KB9MPrVmZeHgCFyqXHH:rP4m4IpOO67N8KvgweACFzXHH
TLSH
T15365BE2DABDC0096D0BA913885658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b2c3682b290a18cfdf45bc82b53783547db4dfeb86a76787f7e92bd053e608b8
MD5 69d8fca8a732e5db18bdcebb6cae5553
SHA1 4a3d79026daa597c97360aa8dee791dc12388d01
SHA512 c576a89f6e9b48e3aab1ee874a24205c57141504c666aa5997f94f0321fc0722ff2e516ac42fe7800be8e38f8fa487e1541f48843d38b39e7e7f68409cd44272
SSDEEP 12288:tlsflK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:elMPrVmZeHgCFyqXHH
TLSH
T15E75F119E29452E8E26E617AC7560501B373BC2087E1C3CB6AD0F57E2F366D14DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 5c36b8ff11482cebee0664c010435693bb8ce03a1ba1c900deb17540570d5605
MD5 4fbaaed48dbc4e81e874106a62b43d0d
SHA1 6b852a8b7bd9eaf9402c41219a2740f12d9dcc6e
SHA512 1333a6ca9668911acfa7325c822556ca538ef7efe953f12b64d980d5a50ca8f26ab5281735480dc3d51567d9812cab9523231d3806624993ef829065b67fca6b
SSDEEP 12288:bFK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:bFMPrVmZeHgCFyqXHH
TLSH
T191652325BBD0EFA5F7A9567A8516001102ABFE505FB0C10F7D14B287F631EE24CB6A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 0aaf476a5d303303d7ac058ac2c9912568337f60020dd870327d08be7d192956
MD5 14f633afdf93506b298d000ee31d2202
SHA1 4caa1b34f01c4b07f054c7119a5cc1d2d0cd7a43
SHA512 1e64ec96d7ed44a7f66ddbc42c8e7067e2853c990f6bf712ec52c798bb7c49f661938ac5146730b84bf153ad6ef59e70875b5b2302cbbc17e82ba853cee48ae8
SSDEEP 49152:4a0h2GEkuAe73q3pp46zwwQbgweACFzXHH:4a0hNYG4JwKgrACFDHH
TLSH
T167859E1E67EC82B5D1BAD278C9A6814BE6B2B4220B3156CF1150853D7F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 66b00de8f7fb39ed5d3410b323525444de44725255586f8a80ae4d183cc10069
MD5 3eaa5372bae382270f0b1d046d44066a
SHA1 a1e05082ab607729ec81a558084dbe8ef9d9aa2a
SHA512 58465607ad2f3a1f75c7e9a4a69a008738b85342d25dbc9f60b77adec0aa8a03b7b68c3c5cac3eee9d97cee63870e51a3c5269f4fb5b9f16ad7ff983643cc48c
SSDEEP 12288:UhbHjfXOK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:UhbHjPOMPrVmZeHgCFyqXHH
TLSH
T1A365027D26EC25E8F271A17D85564106C372FC101B2183EF2A9092BAAF37EE54C79F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2925230e96657078c4b16cbe3edca40ffd97322553cb82aa298a62f8ac00772f
MD5 3e277e64371a21b3859d231e678fd731
SHA1 d2842adde3b8ed28a41d319aa00d140e0038fb17
SHA512 8b11f9db9b9036a0dd96332e509f5d05d2487e61389e201adc36c6a151b5013b8d60a552a3d5c33e44933e76afcfb5abad4429e65ecd2da42a39962f4fa7d2aa
SSDEEP 24576:q3YgnJcRTk4yti+R5dpR/WMPrVmZeHgCFyqXHH:qIgnaTk46ppR/WgweACFzXHH
TLSH
T18645BF2DF2F910B9D8AAD136450147B5BB71782D1F209ACB0170C538AF1AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 72e846adeb861bab9f7a150867f50ed59baa5a0fc4f67e599daed38ccaba66f4
MD5 cb16bb8d77306da712b6b7c46ab86512
SHA1 e0c33e18be6fc13757e8c43dd86ff632028eafe5
SHA512 8422878fe8fbd0fd7aaa45279a9d8f8b5f09d7bca4c02b06de9022886c1b8a602c4fc608e0244dbb10a781d5162f8124e4575a0faf03a7b5d2fd6338487986f3
SSDEEP 12288:pJK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:pJMPrVmZeHgCFyqXHH
TLSH
T1A8652354BAC1EFF4F755567B861600020196FF405FB1829B7D28B287F332EE748BA926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 83640be9b3ee7b932442b46137c4521a897cab53abbfe4a333bcba304cd94b3b
MD5 f820ba23f6e2d5373f60ad07b0e6012b
SHA1 604e88a9ecacdae27bc60b6ec2684d60223cf72f
SHA512 f158540c8d48222019d13564e927b0e3a5e4f60b397a70c80331d4fde316e8fa652145f6415e0745dbd269474b04471081504351e9ed3f33902253d5526fb435
SSDEEP 12288:JObAA4LWOsvAYFTsK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:+4L3UTsMPrVmZeHgCFyqXHH
TLSH
T1B785F155F7D004F9EA6B813DC9A68512D2B2B85C0760D7DF07A88B562F237E24E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d4345b2e1d28a9741288e5ebc86923af8d90095a1d2cd03b46d9c0d3a06dbf3d
MD5 f4ad14bdae06a9da69f67efe66373a0a
SHA1 9d99b12b5445d419974c42374282f147b61f25f1
SHA512 dcef08ec2b0efbf088550d286ffaa42a69a495180b264ab635d40b4304cd937912bbdee599ee6e0c780d662a1de2aa03f5256f31a0b591729870e9590ce314ac
SSDEEP 12288:hpFtlOwK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:dOwMPrVmZeHgCFyqXHH
TLSH
T1BF65022937DC25E4F675A13D86524209C3B2BC610B6143DF0A9091AFAF73FF85C7AA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d4ea813422a58451e47aa0fbf35690240f1ccef82b16c36be9ce3d16de42c11
MD5 b688dd09ccf6366afaa423ed6da3db8c
SHA1 f02af37f9b6cdb1ccb10b428ed5aec402d831d31
SHA512 31aa0233d908e21a0fd2ffdee0a0f7bbf1ced169449ae3d9c6fc84b9118bd68fc125137a1f73f0361e4867d226a51d6d95586695e79b83748a474d6ceda4ee54
SSDEEP 24576:07NM9YmZqmWMUkPjZM48Mv6bEhs1MPrVmZeHgCFyqXHH:07cBWMpPjN8DbEhugweACFzXHH
TLSH
T1FC659E2E6BEC81E5D576D13DC9A28205F6B2B4611B318ACF1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 483cde0f3c819276aad6e668713897061574cd0524fddfca5f0ba4cb5713e62f
MD5 201e70e8bee100d013f55bde35d76923
SHA1 b0af4babe669671aef1999fe9da241e4abb1484e
SHA512 e758a2030cff375f75fef7c01349fc0dad89a1215a8bdb3b93fbcb936b333c8f8a860bbde2011cb5adc24f47695e87fca6785d6ca243c624b2685b49a95477c0
SSDEEP 24576:3W6BApg2YuyuNDYTabvcRvNYf8km1HMPrVmZeHgCFyqXHHI:3F2YuHNETovcvNYf8kmVgweACFzXHHI
TLSH
T1D5857E6927ED80A4E0BBD27D45B79246FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c8f3370dd7132bbb8c5eaea356e8ca21a9daf3ea2aa31c4e4de4ff820ba8bd7d
MD5 95c4d88c7c580e3923c81ddc54148ea6
SHA1 4c39ba8599703ea421e59d0b2b544a318ce9b13a
SHA512 b5c074923677aeac607b50e8cbfeb71b91b9fa959dac47ce001e7429e3ccb9f91fee4cbe41e4484236e7f8b5610c0557d6cf8340a4036123f98905f685d668f5
SSDEEP 24576:zAFs06+OmlfQNXEbToEMPrVmZeHgCFyqXHH:8Fs060lcXu7gweACFzXHH
TLSH
T16C65AF2F66EC00D5E07ED17E8997C916F6B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 c5cc72e222448d191da41e5659f56fde38a948e8f94b33f4f92bd8f203c149a4
MD5 abf5aad89737d992f1f6c693897461de
SHA1 a99eb758766683c93a4be88c6d10ca9eefc0f1b2
SHA512 a131cbf4c8ab7ad57cf27d569a42200672c98569f1806c5cb39f5ad1ecc6b2f767250e9d30463e4845a14b6f53ca7de3139e46b428d831fcc16196a61e20d7ba
SSDEEP 12288:XCJnJ5D3VkrIzxVK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:yJnJ5D3WM7MPrVmZeHgCFyqXHH
TLSH
T1C485D02DD2A810F8E4B7C274815A1746BF72386D2F225ACB28B4D5357F22FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1bdc71441d4bd7730f69f79c61566ff98839ed6cd98de17f4681fb3f2f53ad2c
MD5 d6518afd5e035aefa749e9300852a36d
SHA1 62d228c218cf15d915ccd7a49d1d33056a0d486a
SHA512 5918917a7261bb1528ef14afb9b00ea083599256b0d5a02f7bf4dfbad62c786f9ccc49bb50cf07194c947ec3f06225c18c8e69fe152b4e8bc2e3e7549c804d9c
SSDEEP 24576:MEPohm6/7IIXdwcXrif7qQncjlP65i3VuWMPrVmZeHgCFyqXHH:To06DIKdwc+eQnSt65aVhgweACFzXHH
TLSH
T1E8956C16B7EA5294E9B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 99f535fe3a06382ccf433d68b6a114626c5a80e4fae37f325dc46739705cb4bd
MD5 210c8f318007842e2d7b46c625cbe341
SHA1 d15795ac18a75789efe5fdf8ef0dc7b1cc677967
SHA512 28fc91949852e829ad2b2f39868d6defe9b54a86901731de7b7db5f6ad4f0045d2d22e4ab5f64193517d3d1f99202fc131885e5096a1fc809a1ed1e2fab5068a
SSDEEP 12288:/EP3R2/K6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:E2/MPrVmZeHgCFyqXHH
TLSH
T16E65026D7BD8B1E5F22A913E85914105C3B2F4601B6243EF1AA0D27E9F33AE61D39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 ff35abaa388f63fc665ab20cf60719168a5f95fa6b5e8d1fdd4e4f002c2289eb
MD5 ccf2c53e4e68fbb13e78a3e9f4df1020
SHA1 f1a34eb6bb060a01df1bf6a522313cc370eb4067
SHA512 ac32548f77263d8ee5f447d19875d5b51ffe79b3f699c7808f042bffcfaad21b3a888debd0b239b10d562901441337686532fa27744b4961d1fbe101298761a6
SSDEEP 12288:yjkyeK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:yIyeMPrVmZeHgCFyqXHH
TLSH
T11075120463D4AAE4F7A94639CA6341414A76FC205F3182DF6990F22FBF32BE19C75B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 921afa217b2c67eb7b7de88060dd21bc214d12f36446fa79c1c0222daa20e905
MD5 99d86a2fc6ad7a1bb83513fc98f5417b
SHA1 1e776e6821cc92850c667f96a9fd33d7ba6e539f
SHA512 e325943a57e5f830dfbb2eb405a7bdfee7d6f4cfe420a93c9b99a7c81a020c65e54ebb2db40fac09268d9cbb82995720aa6036a0606e3537208d6b2bb0c72608
SSDEEP 12288:9hAK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:XAMPrVmZeHgCFyqXHH
TLSH
T1F965235876D1BFF4FB55457A8216000201A6FE601FB181AF2DA4F2A7F732ED348B6D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d30f5640a2f8fc8ac9eedc0bcb6f9b9c4b769ef1993c961a47427c7031b67bbf
MD5 ce24a245eeb581606850130cd708503a
SHA1 4774ebaa6bd55fba1fe2e79ca7b90587821e5884
SHA512 2127ef2954b40ac08f8e09ed2c26a75eb2d9375fab5f6fbe0895afac66796e6be2fd9b966617fa30862b86e60c83d463c6449672c46887eaa0374f7c20faafbc
SSDEEP 12288:vLQZb3C97GYnZMv5zBcKY97MD3tK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwa:TQ9MxZKdcz97w3tMPrVmZeHgCFyqXHH
TLSH
T1F0557D2DABE90999E177D27995A250C3A673B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 5ff70daa11a6e7c67149f129aa6b2385014bf31e48cbe6d8fbcee39c1f185f12
MD5 45560e89e81bd2fee1a05f7282a6874f
SHA1 aba9a6636654d7c5d59497035f32ab4103bae54d
SHA512 9c78422297b26c42a4e5043c6519781feb3b8e40070acaec61c69d5184739280c54e9032503d76c4872179668ad5af89c355051a37a28e597c254c58a821da78
SSDEEP 12288:4yoKo2iRple9pCK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:4yocQApCMPrVmZeHgCFyqXHH
TLSH
T10775E11FBBA940E1E266813C89858245E7B3B4305F6253CB6591C33E9F37AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f0f6d085486623d13a66812a48718e3046f9fcf437b7063632403c9688d298d5
MD5 dac9e19cb9ee01e94d61d13157452ecc
SHA1 a9b4205d289f8413f262a17bf3074d576915c722
SHA512 7dfaa5999f6427bc0b5bda4d0b466d0e6ddd3d3930e42da0b0c287ad4b4d701916ea86188d2ae8623c9634265c4e070c64ae1487775402962e1b93f7b503ab4c
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKCgweACFzXHH:x0zuNImgrACFDHH
TLSH
T100A57C3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 64f0b1e528f2e6d9c8347b22fc750ac9277adb1d2310bd12caa435577c530f36
MD5 e8153a63b94fe2fb195d709a5b946deb
SHA1 6392f6b6ba7f568d1148c091418a42e598e17ce8
SHA512 9f8042063bcb69271f77172962a4929010c940bcc8e3ec9466b0332a6859848167e8aecec9328fe68fd8a5e9fccaeb30c543b703db94fda40d74f57d274fcee3
SSDEEP 24576:N1QT7EcpfxR+N5AWAz3ooiYsjMqb/MPrVmZeHgCFyqXHH:4TDxR+N5YzTujMQgweACFzXHH
TLSH
T11055B02EA7F855E9E1BE85798A238502FA727811073193CF42A0C17E1F779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 75c679bfed8949aca292d0f792ffa56bb82b12aac504d5dd48352b29653a3b44
MD5 7b6d2b9ea33bc2a74d661023df3ef6fe
SHA1 b4cd631b0ec231fbf2933efed622b58780cb98b6
SHA512 0de929969501db9c59b3a83628bad700c1d3173666e0994ed611bfec56a5008297343b9c9c2ec6557f11e9b9b063b79ac7bdd9abf7cd53f790b5cd8095ccdb18
SSDEEP 24576:BTMdOz0FFS+QmSLTMPrVmZeHgCFyqXHH:r0K+QmSLTgweACFzXHH
TLSH
T1AC85E13EA3AD14E4F57AC27DD6438906E67278610321A6DB0690C1BA7F67FE43979F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 cc9b216e0a5ac57d283d713f0eee70894ec27b74c1e7bdcadb3d23016133520a
MD5 c33c494d0789af26d0f86d8c7ccc6b44
SHA1 aad4db9f26ec6f5520ccc2bfb7611c481ce6eaca
SHA512 e679d7762a1fc9335dbd8132b3ee26c0baf1defcf318879c4fe79720e18c499ee57ab10d0ba1d14f2c8329458061411e9be1c2dced7db2a4626c7ab3073ee9f8
SSDEEP 12288:V4gsK6236urhHbmZeHTU0REgl/jrWCD5aZ1gawbwaHH:rsMPrVmZeHgCFyqXHH
TLSH
T1A365121D67D479E4F6669239C62600024671FC601B7182FF3DE0E6BBEF32AD58879B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-482-0x000001B6FBE80000-0x000001B6FDD57000-memory.dmp

Download

memory/648-541-0x000001B6FBE80000-0x000001B6FDD57000-memory.dmp

Download

memory/936-247-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/936-250-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/936-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/936-241-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1200-6-0x0000000002290000-0x00000000022F6000-memory.dmp

Download

memory/1200-1-0x0000000002290000-0x00000000022F6000-memory.dmp

Download

memory/1200-0-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/1200-79-0x0000000000400000-0x0000000000587000-memory.dmp

Download

memory/1392-480-0x000000000DEF0000-0x000000000DEF1000-memory.dmp

Download

memory/1392-475-0x000000000D2F0000-0x000000000D2F8000-memory.dmp

Download

memory/1392-477-0x000000000DEA0000-0x000000000DEA8000-memory.dmp

Download

memory/1392-281-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/1392-275-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1392-272-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/1392-484-0x000000000AD70000-0x000000000AD78000-memory.dmp

Download

memory/1392-472-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1392-479-0x000000000DF00000-0x000000000DF08000-memory.dmp

Download

memory/1392-316-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/1392-297-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/1392-485-0x000000000AD60000-0x000000000AD61000-memory.dmp

Download

memory/1776-209-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1776-211-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1776-203-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1776-215-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1776-213-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/1784-112-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1784-109-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1784-225-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1784-103-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1800-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1800-217-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1800-468-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1800-223-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2040-89-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2040-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2040-88-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2040-38-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2040-46-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2280-100-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/2280-97-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2280-91-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/2352-55-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2352-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2352-49-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2352-175-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2660-432-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2660-173-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/2660-176-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2776-130-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2776-249-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2840-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2840-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2840-446-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2840-443-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2840-152-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2840-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2880-27-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2880-34-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2880-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2880-129-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3208-141-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3208-261-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3208-139-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3208-133-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/3240-198-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3240-192-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3240-467-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3240-200-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3304-235-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3304-229-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3304-469-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3304-238-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3308-262-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3308-259-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3308-471-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3428-188-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3428-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3428-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3428-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3508-189-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/3508-180-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3508-186-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3508-452-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4048-11-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4048-111-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4048-12-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4048-20-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4688-365-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4688-162-0x0000000000700000-0x0000000000760000-memory.dmp

Download

memory/4688-164-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4928-77-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4928-80-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4928-83-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4928-85-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4928-71-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5040-123-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5040-115-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/5040-237-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/5040-121-0x00000000005F0000-0x0000000000650000-memory.dmp

Download