2ecf5b056c0d77646f14997ae3f7fb53381b46e975b911d6af1c05e247e1389b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/09/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Size 1.8MB
Sample260926-2n5f5ashqa
SHA256 2ecf5b056c0d77646f14997ae3f7fb53381b46e975b911d6af1c05e247e1389b
MD5 5354ec56553f3a20434a8729a5eae457
SHA1 ee1087394e56db24cefd87aa5afe4a6f2343709f
SHA512 03c3fcd64c2afee6b44424cd1be18a591931db14dd0e05ce0bdf57e5d8c832111b9d61e2cc36dba3f457c8b63f17bd5e7d71bc00906270e3c387fffd47384826
SSDEEP 49152:mr//rl8mm1URHtqVRcTwCVcej4MYPVyGLW:mrbuhUFto3CViVC
TLSH
T10D852311B5D480B2E173193056F0A6F06B3DFC306A35AA5F27C53E2F2A75692EE65323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4952	alg.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
788	fxssvc.exe
4288	elevation_service.exe
1424	elevation_service.exe
4264	maintenanceservice.exe
3576	msdtc.exe
4392	OSE.EXE
3056	PerceptionSimulationService.exe
4660	perfhost.exe
4620	locator.exe
2032	SensorDataService.exe
3352	snmptrap.exe
4008	spectrum.exe
1768	ssh-agent.exe
1552	TieringEngineService.exe
1924	AgentService.exe
4680	vds.exe
5052	vssvc.exe
3768	wbengine.exe
4140	WmiApSrv.exe
1304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1af41d1960f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_bn.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_en.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_ml.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_ru.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\UnlockSwitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_ro.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\goopdateres_ms.dll	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM8057.tmp\BraveCrashHandler64.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113156\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000d1752af084edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c873d0af084edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c4eaaaf084edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d09bd7af084edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5adeaaf084edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027be3bb0084edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4452	DiagnosticsHub.StandardCollector.Service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe
4288	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4548	2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
Token: SeAuditPrivilege	788	fxssvc.exe
Token: SeRestorePrivilege	1552	TieringEngineService.exe
Token: SeManageVolumePrivilege	1552	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1924	AgentService.exe
Token: SeBackupPrivilege	5052	vssvc.exe
Token: SeRestorePrivilege	5052	vssvc.exe
Token: SeAuditPrivilege	5052	vssvc.exe
Token: SeBackupPrivilege	3768	wbengine.exe
Token: SeRestorePrivilege	3768	wbengine.exe
Token: SeSecurityPrivilege	3768	wbengine.exe
Token: 33	1304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeDebugPrivilege	4452	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4288	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 4040	1304	SearchIndexer.exe	115
PID 1304 wrote to memory of 1588	1304	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-26_5354ec56553f3a20434a8729a5eae457_amadey_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1424

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4264

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3056

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3352

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4008

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:616

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4140

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4040
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29d1f07d883f10d46c7003725578ebec1065ee88a0a9fbc9a69337c4504d9ca1
MD5 85e87ff9f63735d8280eb26447791e14
SHA1 0ba12bd1135717d59001f6a375763c9400a9452a
SHA512 252bf808fae761e2aee07a36a8aba9f9d04bc94318e1f9506ce6cb8c9090121959e40c18acc6e8e3b22b71166daed125040e9c79ec62caa07b45aaac09aeb2fe
SSDEEP 49152:Cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnRj4MYPVyGLW:k3q6mjBVVa
TLSH
T138D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1c96e68dc264a291bc6e56980373919b603483a58be6cec9895c9bac6554db11
MD5 49cbd270de2616b8c353677566cafce9
SHA1 992b019e61332b4ad3b1bd29f68829881179770f
SHA512 e77dff5711738141678c57a31754017b531adf59ba337097da3e77142d5bdb7287fcb59d42b0caae76a229e2b71dfe77ac6fddd2af431de1522eeb683c7f53af
SSDEEP 24576:rXYfDtczAR5SnnrFb4PM4MYgLxEVyGLn:utcPj4MYPVyGLn
TLSH
T1D365F12977E408FDDD6B8278C8A28545E633B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d171095ceb2095ab6db63e5894654905ec924b1f695c18ac576fd2c3ff4add2d
MD5 95d1f70978cb19b4ea93fd7120b3dbd0
SHA1 9d455d8be6ee67f8c27dc9a8d9535f8103c7d043
SHA512 356e3b8d49b8dc33117512d621bbb9e5ed2def03188a635614ba3451c5dc64c0f7a94f05fec3293068d8e533fecdce8fdba50b5f0d32095c381c9908bc3c6ca3
SSDEEP 24576:50Le5ji0hmxhrMg5SnnrFb4PM4MYgLxEVyGLq:5Pji0AzOj4MYPVyGLq
TLSH
T127859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2885ca13833b8bf0f9aeec09a9d19543088514940531e3ba57e27c6814278e6a
MD5 772b6c3f2c27cc6a57ff9760ceedebe4
SHA1 772b1073fd63ec00bd2c543e4da808ea5ad4debb
SHA512 9f86db37a46d9a5e5801e4ce35b39a74eb2c0bbe029627ae2e4a389b84a81e66994bfbd57249dca6c5273c7e304567c9cf3211525a61a615d2add4a3dd42dcd0
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWj6q8wyu+5SnnrFb4PM4MYgLxEVyGLy:r/ezSC6vUzPv+Hjyyj4MYPVyGLy
TLSH
T117755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 937d296460f48b072f51d64846cd1a178c57980ea21e9095fdc15d0c7114af74
MD5 2fe39c56a8076b4900f3f1cc4bf8c199
SHA1 70d4b152a75b7457e97a8aff15529769764fb6af
SHA512 93182713863f384f59619a3070a4b2dd9761c27c2cd65e5f8215d668ed30b5e23bf80f7d8a6cd003e630fd9036aac484d8caf9b128e02d9dfcca81b7f681e7c6
SSDEEP 24576:WVbqPb88hv/l+B15SnnrFb4PM4MYgLxEVyGLP:WVO88hXl+uj4MYPVyGLP
TLSH
T15F559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5f22bce51d72a8f4f99b9291ada6bf36878342ae956bc11a6f4d8021e451dfb1
MD5 08f36e53f139ba53fd5f4218a9c495b4
SHA1 59601baf78878ff71b6ac92239fcf8b1d2847a2e
SHA512 08ad31c360c13661176b84cdeb69e85ec6459b36a48d10686b0379a00ff864a686c4753da09308073921cbf6097159214628def5dc27ff907d6cf272805ea460
SSDEEP 12288:hGEK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:hGE5SnnrFb4PM4MYgLxEVyGLm
TLSH
T16B4523A65BDC10EACFAE15B0D1F96AC8E205BC61F875B20B6751785B363F20DD892313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 12d93ef82890a5564551d0aac5b6dd6d6398cbd5df228a3ecc09658d30e6fb59
MD5 591cad663f9c6d1891ab8791b89b45c3
SHA1 7169307908e6021b188a33cff9fb13cdd34ec9ae
SHA512 8fdbe37b00e433c86a8b9d98ecc928b7acf90c7b9eb20905a0fd081607480b6284cda636f1f22422ad1725fe05a3be5a93e5620d1236253aee55a0bfc4c2972a
SSDEEP 12288:jeBNUbTVO86UNK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:jJIUN5SnnrFb4PM4MYgLxEVyGLP
TLSH
T1D665D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD165820E9E235D45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fa0c7772026624e3f7dc8665069cceddbe0a6ca565fa48a78cd0db0c5e3764fc
MD5 85747158f0d053c3cb4f216fa2f89984
SHA1 224cb6ed0a8e9edba27c716b59abfc7ac59cccb2
SHA512 e88735789d60817512e3fc7f0399744227f1addfe13072566bd286e51e347ea7dde1cdea452e7024f73d64a948125ecb723e2933773b105bd5c13b4b557e8f8c
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:2QvGAdlCEL8c/WRNw5CsVP
TLSH
T1FB267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 58f253996fed83c9e4100f5eb8a3813523bccf8b08175cda6842df8d2953cd70
MD5 bd4f92d063854ee260e428ffa121548a
SHA1 2c4b91b6170eba21d8c584f3fbf6a28cf48594df
SHA512 845c7f27d26155a8316bf5ba06c3ca12d3ae5cc3f972e9ad176f13bb0447f4871eec8caddf2c1bb9b4fc7367f16dee8df652203742b7a76646e205e9574355a6
SSDEEP 12288:IAwSfxL/2Dc3mDLLmt0LDQewsAj7K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLer:tfewsAj75SnnrFb4PM4MYgLxEVyGL1
TLSH
T10E75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1289af9e3ad0c17706aca4f720c1ac0c86cd2cfa9fed016916a2a0fa97514247
MD5 1d82993808621878f7b681a77b9e1df3
SHA1 5286095f53dccc2ef2b38adb37dc875b341b0bf5
SHA512 51028021c9be601ecdf9fce80a9ffb0d0f0a86ec4fc5b90d5215077d328f16bc73bedc726c7e59e0ec64d0387be53587ea9a5e28b1b09a09f418ca98d9c9da15
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH:QUEtQevvqc2W1cpV20I32
TLSH
T16B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ced7f02a6f8fce9559bec5cad3ad79e4a3d53cce454680f3cdd9986e01ffca8e
MD5 2ecfbd6159254862108bb9e71c341bd0
SHA1 c121e1ac81b6e4ce87d64630b8570a01b1fd0b1b
SHA512 cfcb82ace5e76007c0168896fa2c8605a45e0b0ef4a14b0b07186269c09e548866cb3f1a8ee298e77632dde0cbe5f996f52528c842c1dc59d72b555c7d39e084
SSDEEP 49152:qCbRquA/m2yL5zQfFiV+XenmE3/zej4MYPVyGLn:foqtVjnmwVz
TLSH
T1D7D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8f06ad73bac6976341dccaf7f0c5409cabaa391ab6e0664dfb04075957c6426
MD5 1f9bb51b521e7b958fa15dcfced99832
SHA1 c777b734388c51272e3eff8a3bcac5f36aa7492f
SHA512 9a0ba40032158cec6d7fd5f0939eb05d3fd2c0c6e80863a7dfc4e2e9020bd9e3db6cd6135296529c7e10cd1721be650e18977512cb5e50576725585f025ee383
SSDEEP 24576:NAhGL6IFoiwtA5l7S53K5SnnrFb4PM4MYgLxEVyGLd:NAM5Foiq5Tj4MYPVyGLd
TLSH
T13335AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 085e535617d517d198c1c38c7c1276dff63143b29d66077fe229c7cde5e66281
MD5 63e5bfc21728ba4e7db672aa9ee85671
SHA1 e25763081854c030c9b122c726c1841b6252558c
SHA512 4b1c43f8adf7659c4e6544d719f34d0548c87c74ab92dd97c1fd34b7ad1196b4260cfebb17c583d357a906e148016309c862c86402b771d91e22e1c7db052c90
SSDEEP 12288:+mw5HEjsChNEBFgl0WDm+CeK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyJ:XwuROWH5SnnrFb4PM4MYgLxEVyGL4
TLSH
T16265F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e9d60730587020161b5826036872bb8930552e80b52e7b6e0a5c8709f94ebe80
MD5 01ca91d93d0859328e412116d535fe62
SHA1 58fbdf1871f95ca009bf43a1925544519562550e
SHA512 76336c07d0c6053504491bc8fac55ee9d4dc9d41e5841c33b3ba541c4e8177a1bad2fc0179dcae2ea99bd1bd9e33c581a84e6bfc951d4df478b199c41403ca61
SSDEEP 12288:uyZ1IyLK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:XZu45SnnrFb4PM4MYgLxEVyGLK
TLSH
T1825512AA37E820FADAA74274C4F55688E3227862B73293CF1750655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 218552491405816a1859edc25208beb918dcadcef022759649d2a6c9f8d06486
MD5 f0d8146d148adcf39790951940377aa7
SHA1 325a00125ef8f4704eaacbf47f757dd6af39aeac
SHA512 64db30059f9c6a48c09452f5666cebc0d95e6c44c919c912746c3c22bf7200944ccbb93b429219c6c0484c172d3ad0368112b0add6e737ac3897d99a0627d811
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UM:cQRQyi36YOcPDLvw2gAf+PN3hVs
TLSH
T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b8504ed6adb839da8f7a083f02792a8251fdb96096e674fa6437904bada66c43
MD5 b1f315825bb2ba01e84cf1ba1875b31c
SHA1 4f4f2b41d283c3f2adf23648745b873e7fc5b81d
SHA512 8f2c01f2afd03e1c9369e0a0d3faf5c2001c8620715d6929e7b2a60be755ca6f053ea9cae17deef545a5985b168e038d552b3922f1693738d50b13fe0c83aa82
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UG:/QRQyi36YOcPDLvw2gAf+PN3hVm
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 412d75914da86b696849170c67fe581a76ec91182795e177c6dbd86e2a056fe7
MD5 7f655a19ddec4d36301e2a509c985ea7
SHA1 a7dbe7d4a13a9865e96d86fe2bfa3566edb3a7ea
SHA512 5716d0dad81df5b721418d893f265481398529f29f312354278a6866b2fcd29bdc86fffa3db7749414e6cf0a58809099e24e8df33b27c21036f6d317473e6007
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0o5SnnrFb4PM4MYk:Z68Qg55nhkeWu7PNU3/Oj4MYPVyGLg
TLSH
T182B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 74520a02dfbca87dc86861eda9689e92fec8682ad09ffb1538def3ff0fcd5c16
MD5 9a8b70fa872e5bf05d096f001d5a0c20
SHA1 c38afade6653aa58c2ac4311b7bca2b35ef46598
SHA512 0a0dc9d099965fbbca9614432f6c20feb127b1d09bc6b25f2db3d2de83f6e6afb5116444370ce6d3dbc2f781b56c40bea5b8b2a37eacd7d8db89084d8c60894f
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99L:xy5112gYy5azzVvU69nLKnhZeVt
TLSH
T1A4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2b915982e307b22266ad9aa42590953dae713521c1eab89ad89ba1b70afbc905
MD5 5e63d4b279acae2fc00b03df7019377e
SHA1 68202162c65168825da7fdefa61fd17516d46d01
SHA512 c40f1433db8e24aff3c00249e7be8189fbbf958cc911f3453ca9fbdf64e688be6328d181818932d7153fb322fc20d861d764947207e361c14a904db5e4f2079c
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glsj4MYPVyGLs:Mu6JmIxd2d5VY
TLSH
T172D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e28240a387ea3380a8744c6592bac3cced747e6d2f3afdcc5fb128e74d8be704
MD5 2dc1abf0e7ba23534f54c3ecc402a61d
SHA1 8faa31f79ed02b86cbba89c8978da581acc40aee
SHA512 b9c4dc324d1a6fd3ccb5a72cf65927320c79838d529395191df6752f6e80379c387eeaf33390c80b84b213216f08d8649395b3158772af4294a216d65c854270
SSDEEP 49152:G1hpsNoJpF1A67U44CwH7R4xAj4MYPVyGLO:GmifPqRwVa
TLSH
T195B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83c0bbba917f98cddbcdad3c5d8d59ecc6a60ffb950c53e576d589edc7f627f3
MD5 b66175a4371b977d30856984783f8970
SHA1 602f645d261adb1b5e1b702182566d258802d1fe
SHA512 d099c0f9065683b4990c551709ae92def9fd3b0fa1f92a75ed454e72c067f4f26a84fc21e13dd3985747eed33025597f17fd80e29b6a96fd9b96a93a7c4daf5f
SSDEEP 49152:DSuZQIY0Be2KkRVtOnks6NMHqBj4MYPVyGLn:h5dKqi616VT
TLSH
T137C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f167d3e7ffafb0742bc6d898d9b65b91b6aa4df54548da90fcd410c764d42e84
MD5 cfdc6364187a41a82772208a36d3744a
SHA1 c13b776e5e5308ed31a0f9048663b3412b07dd0a
SHA512 e56e80657951a8c475e6942579699ca381af7f3391adbef5231ade25809119dcb0321f4a202724df28bfce88ffa91ef6fb0fc6196c0e9e36a7db1ae5c5047783
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5wcj4MYPVyGLL:kX2iWphUVP
TLSH
T15595BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 412cca558deffcc9abc96bdd02df1b676af2fdf0df6f279385285f99e6c511ff
MD5 bdb829bc1e61235316eccbbefc2758a3
SHA1 ff743af7a4dec2c3ab28a05be5aeb764699cbd30
SHA512 ed4adad676508f016428dfaaf7985bcfe398c2461ad16599277f1cc179d3c68d272e8a2a4e4b63f36da9b4e9675552be1d70f837346d2b51c50fe38b6d63ab97
SSDEEP 12288:pcK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:pc5SnnrFb4PM4MYgLxEVyGLq
TLSH
T1364523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F774574073B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7ecde5af4e7004558703a6880241bf51935767993d97e0fb43d4c81c403ddb15
MD5 d248ee4f31800a0b08255d958d0dd552
SHA1 b1815e7844150ed69dd117115325c82291129a29
SHA512 f858017343e69268d7a0227cf5459e8af65692bd9c6202c359a280bed4c81eae6d03cd0076463e2009e4a3105dedc469fe1fa123bf7b88a5511509067c87e0d1
SSDEEP 12288:kPK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:kP5SnnrFb4PM4MYgLxEVyGL4
TLSH
T1704523A62EDD10EFCF5D16F0C1A956C8E2097C63F976B20B7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 27f78706dccb0e17e1ddfeb61ef02ae8629d9bd38868523dfec8dbf315323205
MD5 4ddd3af2646c863dcdb8d36380d5f2fb
SHA1 440171c73fe8a02a2202d7a49caba656b83d3c89
SHA512 8611988609a59ac1145d323d88a80b3f82357f2dad94cf0c9fad2ae457d60d6c0cb7523ca1fd1b04591846b63f7543b00e0fda23c4f41eb77b8ee51ee9b97357
SSDEEP 12288:2lK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:2l5SnnrFb4PM4MYgLxEVyGL8
TLSH
T10E4523A62EDC10EFCF5D16F0C1A956C8E2097C63F976B20F7B8574063B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 050c43d436cece6d3b0ee5c4c476c1f74a2d150d80ba1b61c0df4f63298d1a90
MD5 4fb8b1ecc7b4a5ad51585e8b6de9b460
SHA1 ae051f99aa92420b73f5e11a9a2c2c7a335f2e9d
SHA512 a7f6ee3e55f8878f8e3a9e361f712fef92e17dd199aa460e0a9515668da96fa34a892e41dc5095ba85d57f4ecea0cd8b5c362ccf3426cadd707e67db3c950a2a
SSDEEP 12288:/VqK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:k5SnnrFb4PM4MYgLxEVyGLJ
TLSH
T1354523662BED10EACE6A96B0C1B556C8E225BC61FA72B35F6740341B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a64666c8d3fdc16c47bdc53d935d9fe959a9fa2cdeedaecc33bf9fead564a437
MD5 5b175a3a75481dced11e4d646bd1e442
SHA1 ac707a7aceb6e18bdf20af8c0aca975cd1d2f0b3
SHA512 eb7578ab0fe6e9f406ddf9bcb3c2cd6f5ba7d86e7e0f3416021ef7bbf92c23b29609753e07390a3743a0483f1b7991ba72874a9318a8e0cbc7174836690422c9
SSDEEP 12288:zSK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:zS5SnnrFb4PM4MYgLxEVyGLg
TLSH
T1E34523A62EDD10EFCF5D16F0C1A956C8E2097C63F976B20F7B4574063B3B20D6892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0fbdfce4c0de3345b429a8cb96ce42cc66e3446bbc19d47cf947a087446b80e0
MD5 d7d3f59907d381bc9d1c35268a44fafb
SHA1 056cf35b643425b60fc4464bbf2d567156ebce74
SHA512 cdb257e689e9393a0c056517af4e80e9837caaafda3a85d5f86c02f8cf6909e766af393ff4047201c01c42c38ad4ecf4a1d1133a0b98676880ffb346f72f8b07
SSDEEP 12288:2TK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:2T5SnnrFb4PM4MYgLxEVyGLz
TLSH
T1934523A62EED10EFCF5D16B0C1A956C8E2097C63F976B20B7B4574073B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 45d130f39d5b357a5110a5a55cff622e3c71cbbe44c5ecbd72588b9842a318b0
MD5 ac42c02a7da0215d696b9fb70af98e0a
SHA1 ff0fc6eec8d4eaede7d8f9ec5f83f0657b979833
SHA512 dc9ca4da3c496a1c1b6e009b4b63d6894598ea5202595f98724f5404894581df945799335c5eae5d8ef271340cf6c8eb475305cb5b60e8989737fe9a99fa48d1
SSDEEP 12288:Q3K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilk:Q35SnnrFb4PM4MYgLxEVyGLW
TLSH
T1404523A62EDD10EFCF5D06F0C1A966C8E2097C62F976B20F7B4574173B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 36800280420997b1861d8e43f3e2fbb182521ad420a77f6427a05ff26044552b
MD5 8afcf30926abf5f4eec2ef560a55b468
SHA1 0d018e0a8d95b60950c541fcdf7cead5ea8526a0
SHA512 cd551c5edf96675ff5fab9a4bd6bd655095578de6a9a45cef5672a72efa308f0a20a85fc004df658b8b73cc3b22b5334e02775bd15824b093c6ad3d63d51d3dc
SSDEEP 24576:kZM3zFVSOv5SnnrFb4PM4MYgLxEVyGL+:kZM3zf2j4MYPVyGL+
TLSH
T1566502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0dbf684c9f7f82149b29e4220e4d84e948fa87b55f2e2d3d16f6e6af66a04558
MD5 9e7ecdfd0f60f90c1ffe6d99fcb3d78f
SHA1 af3bdf348709501292aeded677d041bbe0b5e41b
SHA512 22fb28b85f6ae0bca433139fb677ecffe81aa3983c2c8beb5b44e088d0f9298b365853b0a117a409d06344a1bccfb6bcc3d8920f49e6d5ee26e5dfcf08a6a594
SSDEEP 12288:IIK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:II5SnnrFb4PM4MYgLxEVyGL2
TLSH
T1EF4523A62EDC10EFCF5D06F0C1A956C8E2097C63F976B20F7B45741A3B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 340c427b166ea2b76814bd6dd22996c6586549bf35a0003945be482f836a6327
MD5 c6498cd705fcc0e5edde8a11de77b80f
SHA1 6575fd2825734bb318806d6a00e520c6dfa718c7
SHA512 b196a7e2f6461d7001fa342ae71803e3f014a42065604bea1eb749ea64f6131a49943b8e0d87a169f85179fa2b72e65370555d0187cc6c607ed44ed6d31b480d
SSDEEP 12288:GUK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:GU5SnnrFb4PM4MYgLxEVyGLR
TLSH
T1024523A62EDD10EECF5D16F0C1A966C8E209BC63F976B20B7B4574073B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c685e92b38508aa64914f4ed8c05befa1fa2118a5cfe1bf19b18b7b8c50968ae
MD5 e47bcca1f0988db34f48d560e2de8dd6
SHA1 fed9083b793867162185216da2fbc6a1c96aca36
SHA512 bcd3d49ce12eb62152adac55edddeb55bc837408788b87047d03f90476f22997af97a2476bbc0d9cf41ed0e25cce92757000c8fd118fae016efc4d135fe1f226
SSDEEP 12288:PyPz5L8LK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:izyL5SnnrFb4PM4MYgLxEVyGLr
TLSH
T17355025737A530FDC67A8274C4A21A45F336B8329B309AAF179016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 87b9580406a5f87d8cf09198af242bd3712728de3f4f94f817ea4d5192113253
MD5 2428a4ef8e8290dae173ab9afbe5eb7e
SHA1 d3d434398bcf62c0fe8d1731d153c70becc93344
SHA512 89de36eee2792e028459f9fb99fa276a5d5da8f02a54a926d86ef6e4ec84e546cd1691aa3c71386aa8ee69e67c8a2ca1e03d93537c93958529896124daccd947
SSDEEP 12288:nIK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:nI5SnnrFb4PM4MYgLxEVyGLU
TLSH
T11B4523A62EED10EFCF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 456387dc393f9da3b4ad0da56831a91063e6fe38d17ec1f9e99eb189d7553512
MD5 b813a88aa675d4d8f461c5b57ff00f92
SHA1 752e725b5f10edb69b3f8ae0a36511c8b82461d2
SHA512 1ddc6d5f810b71d91f735973c6dd58d24af06dbe964e0b82e178def393b16941398bfe86a93bcc88a8694e8f948279741819298efd696361b7d6fd151b6d683a
SSDEEP 12288:7IK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:7I5SnnrFb4PM4MYgLxEVyGLu
TLSH
T1FB4523A62EED10EFCF5D06F0C1A956C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e2d34891ce84dc42eb5f606251080bad807e4633a9241e058888e3c175daaf5b
MD5 3842dbcc4459479ac662252159669bb7
SHA1 6250a46c3f352ea5126894df40d0d22f8f37718f
SHA512 1f9d2dd54de4be6d8d1286fc124ab11566412a8b39c5cd0718b07d590e1a44584f5189aa3f01c61dc8a1f807242979f47eeb23443463faef97dd20808523ac38
SSDEEP 12288:qyPz5L8LK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:3zyL5SnnrFb4PM4MYgLxEVyGL/
TLSH
T1F555025737A530FDC67A8274C4A21A45F336B8329B309AAF179016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 aa01f65f0ed4b66124e1678c00aee29c6c7dad37156784d4f4d818c8299a452d
MD5 58f0b61563dff90cd8c892138e76aead
SHA1 5cca527834c168485831d0817bb789fb5ef3093f
SHA512 586c19743e8ed704dda2a0880ba80e64552b4e674e0135da02461076f66bc4451ac346a343f7e1441a07ab2db72eefde7ed564abbac254ce678ed50964b93cb5
SSDEEP 24576:4T8aLl3z0zDV5SnnrFb4PM4MYgLxEVyGL8:4T7Llj/j4MYPVyGL8
TLSH
T14D6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 64416b33de30318f75e1651b81b7852b652652ae2a42748e1d83c226691de8bf
MD5 3a69cd5f86f019aaa14e28b1673b0a75
SHA1 ee0fbe67707e99cc5bff9a783a8c5e516b475def
SHA512 e3dfc75c5cfed07d3c2d35a9f10ff4eef5b2cdbbd571a9076f090a564801c06c97f769741e82e74e79c29e7bd580a78ef97e463ad86a977cd9020fb97f3b7397
SSDEEP 24576:3cP4mcvIjkGOxhKP2l71nNKbrh/8KBQ5SnnrFb4PM4MYgLxEVyGLQ:MP4m4IpOO67W8Kvj4MYPVyGLQ
TLSH
T12265AE2DABDC0096D0BB917485658A49FAB1742A2F3286CF1160A33D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a7d0b5fe44d09c541b1860a370f289036bfbcd5dd72a3319f2ca39545673aca0
MD5 95a5c342f32890f6d11e0a15f3696c37
SHA1 1b18f9ce825876e73303b15c04f73eb85ce9aa2a
SHA512 886adfbbe0c06311db53e7f777d077f7637d9f8673c3863721f431201438d3b9c59104823a6d9144533771aefb58a12479c3c873aa4cd41e59ee17cb6c8f3a7c
SSDEEP 12288:Hpsf4K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:o45SnnrFb4PM4MYgLxEVyGLu
TLSH
T12F55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b2f4defc672d4834cc606832a66b9391d2dfcf69f1c28ae22e01b0798a21a751
MD5 66e5a880e175c36cdf345e86c01f9310
SHA1 2d033adde470a18386f57c433484d1c98929f121
SHA512 aa987c3141f3a682832675d0b924725f2caad62e489b25c550ebcca3c760bfac0f6a18d3f9863a96d752b8107258de6782588f7a8272eafcbd16cc35980185c8
SSDEEP 12288:yYK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ils:yY5SnnrFb4PM4MYgLxEVyGLO
TLSH
T1CE4523666BDC10EFCFBE16B0806596D8B20A7931FE71B10FB740741A3A3A6499CA1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b9eceb91c8bc7075291ca0ba041730c5d19162689d76a6742823dcabfd8a932b
MD5 50985d96ec28d81b071beddc992b3081
SHA1 23bbc8131e2405860f773d97f71d7bebda9a29f0
SHA512 6b75b116e7a89654c0948f1072b2fea8b7689f9cfee7b6bb2753a9408b1462bee59a3ff8df77d8b966f9964158a300b295f56867aef54fff660a1d4d76bfd9d5
SSDEEP 49152:/a0h2GEkuAe73q3pp46zwwQbj4MYPVyGL5:/a0hNYG4JwnVd
TLSH
T15885AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 dde0a496f601ceee490da74b32d188348971ba7666e0b702deb09674969f67c6
MD5 79d9614a17f5b5dfac3ef2a9e01da00e
SHA1 9b01478b7982b9eb6c2d69b157c37af60f20a6d3
SHA512 29dca543a4e16161cc12cab07f33b1617c0094adbb1d6070f3f3b20e59455098e461e5f7ee620d20bb6dcddbeee2221ea378d03c675d61e18451a41e16e3deab
SSDEEP 12288:xhbHjfX/K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:xhbHjP/5SnnrFb4PM4MYgLxEVyGLy
TLSH
T19455127E27EC20D9E675A2B8C1954649D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8b6737f92eb4c25fdc09880ec8bd66af54179439ba5fd3182019810f86051a9c
MD5 449a5dc5e8a61929e37b770268abc77b
SHA1 cc6025c4a9af8f5b6c1fa909eebab39886712f5d
SHA512 ffa5a750a85a6b442d5396fa9a7ae08fcb311617cd4f7bf2204ed4bef80ee8848a313d8083d5020499bc04addb4933c6a8beb5abe195ff457b224e5bbd0c6f13
SSDEEP 24576:E3YgnJcRTk4yti+R5dBR/H5SnnrFb4PM4MYgLxEVyGLJ:EIgnaTk46pBR/Sj4MYPVyGLJ
TLSH
T15B45BF2EF2B910F9D8AAD236850147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 27ce290182738ca54cfdb97339bff38c72490d8cf1117d8ed9f330515a3b9aa3
MD5 47a9fb183f615a675ad16b2fd644f3f4
SHA1 d61460620721157b4182b517dfed02aba1176ed9
SHA512 35cda3d6d806cb9695f8f524223432711eba216f651c6ef5ec108ebb5305587fc4d12ff8a61e5100ba825fa2ddbf66458bee679d60be92455ddb1d8a169efe73
SSDEEP 12288:4kK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:4k5SnnrFb4PM4MYgLxEVyGLJ
TLSH
T1574523A62ADC10EECF6D56F0C1A656C8E2057922FB72728B7641741B373B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 43b313539ee44848dfe4526525b78c8a4e94d84e52a07cc2814702c8c90c5e93
MD5 3c4025f513a1bee431e67fe965b587ad
SHA1 e3ddb651f19aab1ddef9873f0c4eae3686705349
SHA512 0b55f0999cf01e615310af28750f86f645d2fc6125689471f9f48ffb86461a12419c6b63fd8cb3ee5b145f2902d8e5b7b3f3af9152bbb4306b62e5471366a7c8
SSDEEP 12288:FObIA4LWOsvAYFTRK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ie:CAL3UTR5SnnrFb4PM4MYgLxEVyGLe
TLSH
T1B3750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 28bb601ec8e0c74356b508a1cd25c141d3de71749f17dc7e6395048cf0e6ac65
MD5 87549645487cbf3d6e60810e98748fe4
SHA1 5157d762491673431614a0bd663bec4579595a38
SHA512 edf949b2a818a385660e69ca1b8dba774303f3167e890c0fd1beba0933efd5f85f24fba8f119465454ff8e59a128ba637ff09c266685415c99693b4c6d9062ed
SSDEEP 12288:spFtvOtK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:UOt5SnnrFb4PM4MYgLxEVyGLl
TLSH
T13955022A37EC10E9D57AA178C596434CD331B8625B2263DF0790907E2F77BE86C36B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62c113778b7f120f0a107a0068dca20bd54ce0a15004aa37d288c8ec7c30f003
MD5 4a8512faa650b3440ce2d3849ae3a08b
SHA1 5661b93bc127781d763a2e9175802a61b93159c8
SHA512 7533064e8c4f5004126d5b786e8bdbf209e18081d1141ed3ea517a41f508f8380e499c1418c6b56ec8cbe2d809271ca0b776460c97dd272e1f2bd0517cd2d8c4
SSDEEP 24576:B7NM9YqZqmWMUkPjZM48Mv6bEhsI5SnnrFb4PM4MYgLxEVyGLc:B7cBWMpPjN8DbEhaj4MYPVyGLc
TLSH
T149659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 2961d747a0b7fba6b93b7a193f49f05ae89b16de0851922714c7fb6968c1aa0a
MD5 29c1dbd5b6e51fc7d2ae9c330ee3f507
SHA1 68acbf2e2f4761a1cf8d00c3734c054ac7df1e42
SHA512 a4b7d6375fb09cb1b6f1601a393af1ef12978f1744b0fdf26c55b8250cd5464398a27edd163b926ed7e27fdd74fa2fa171dca87cb4181f84ee3f4302cb2ff90a
SSDEEP 24576:gW6BApg2YuyuNDYTabvcdvNYf8km1G5SnnrFb4PM4MYgLxEVyGLf:gF2YuHNETovAvNYf8kmRj4MYPVyGLf
TLSH
T187857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4e043521ec24de8b51f4ff7cd40a4c162ca2a0473843b6dc9b5e2518f8df98df
MD5 545f9a46983c3af869d30fe7b0c948fb
SHA1 b106eca17f15effd283f575d32593a7445dcc7e4
SHA512 e8aaf6e75a097b8ff973c385f69a805f0aa7e1c41eda968c8ce67e9e9062b661bcc0b1aa7ccb204602ef600816ece58478ea0029fa8173e042456a21f05d4096
SSDEEP 24576:TAFs06+Omlf8NXEbTop5SnnrFb4PM4MYgLxEVyGLj:cFs060loXu7j4MYPVyGLj
TLSH
T19F65AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f286b0333ab4e552956bc13f8cb1fe629fcc55b3da4948bbd98e9fbafb13e79d
MD5 b30525c4ed0213861a775010760a51fc
SHA1 d0df0bdc1192c8e0951e7a0bdcc98a620b154a95
SHA512 5ae374cefe9743355fd77c92281a67f56460b1d782c19e40987229528c48fa2611723d95331e743c02f2793446f51f97480d18cfbab54028bef8d313294fcc13
SSDEEP 24576:AJnJ5D3WXy5SnnrFb4PM4MYgLxEVyGLE:AJnJ5DGX7j4MYPVyGLE
TLSH
T13775D02DD2A810E9D4B7C2B4819A1785FF72383D2F226ACB28B4D5353F12ED09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 155e99af6f03995107643d9dd77ba14f230bbec7982046b97c598664cbee2ff7
MD5 ad7b91211f90cd1f93fc039b4e507730
SHA1 bfe8e2f2fcda9db0ccb50e74fa55fbc179e154b8
SHA512 ba82174ccbacebe1dc9f8be0f257bb2828cce55814f700d967da86a9b82a839425e00e7d37ea396d871d44f305494e00fb364b1b856e04e9003616d476341a21
SSDEEP 24576:VEPghm6/7IIXdwcXrif7qQncjlP65i3VuH5SnnrFb4PM4MYgLxEVyGLA:Cg06DIKdwc+eQnSt65aVNj4MYPVyGLA
TLSH
T114956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 583a997c62ec8fb0964243c4a1466770e9dfeb64a6a494854c635e24991b7f1b
MD5 144880cea5622d846f662a7fa2022754
SHA1 387f6ba60acda6122e826a3c50d9f81849227f80
SHA512 749309c2daae14d4c6247190271dfc896e983f3bf9fe080995f6b759df4842534b3936c5268a22c2b5f37c6395881f1ed123fa97262f07fbbf4e980cb6a89220
SSDEEP 12288:XEP3RneK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:cne5SnnrFb4PM4MYgLxEVyGLt
TLSH
T1AF55126E2BDC20E9C62A9178C1A18688D332F0717B6273EF1691D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 69c79e3fbf772f595f00fe09db7b1d992ae55dfd6e9b58510558d1fc67c9ab50
MD5 c4b2b73cad04772fc334302e3a887424
SHA1 5d16b894f1ebf51f88fc6588f73b48a1f36c8d74
SHA512 8b57fb354c2655f4e1a43d232474bb57093a47634aaf7fc86320bfc1f43471df1bc898f58d9e580aa7a49b75d8472535598b21ab5f256c60749a10d23f8d8094
SSDEEP 12288:LjkyPK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:LIyP5SnnrFb4PM4MYgLxEVyGLe
TLSH
T11C55125527D860D9DABA0674C5A642D4DA35BC21AF21A3DF6280F53E3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 198724dc230f8f1e4b0221f3db64d16b4f79490e9ecff9d2b2173c76629c76e5
MD5 cfad64b641914c8d7d0920e5f05758d1
SHA1 885794c968511a7a020d9c83adb81e390d8eba99
SHA512 31fe5a86dca1f994fc2d253348b6071eeddc8ac799a6502c1804513efa78a7031cffd0591d08d7ac21a10e2637a863111adf80a85d5b34d1145d68a3fd423cfa
SSDEEP 12288:Ry9K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:A95SnnrFb4PM4MYgLxEVyGLo
TLSH
T1384523692BED20EECF6906B0C1755BC8E2157831FB71719F36D0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8d43511eab499405c3de78bc08c5adbcb41ac21e81e5d492686ef29719b426e6
MD5 15ae96c9a1f7c36e1bcb5413240954b3
SHA1 dac2e26428a69328ccdbcbd15507c92893794f1d
SHA512 0d2b3f1d255d68427c383dab4fed6837fcabf4cbcac950c3d8dbad314073a1efee141b4ad6982edbb6551ac35105257645a1f76573920f77f026b0e65eeb5869
SSDEEP 24576:3Q9MxZKdcz9dw3A5SnnrFb4PM4MYgLxEVyGLm:3VKZZj4MYPVyGLm
TLSH
T149557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 0717d0b24b5c00e261c63cf70c7141c8630fb09e8c4bfea51bd0086f536d1b29
MD5 a81292eb6c159d781955edffa0c54b47
SHA1 f304607b0d181e3035d988552484f88680b2e92b
SHA512 1fcb1539fbf234329133ee09b6cc262048ec1ad93318a8856c9b2a85910fb7b4f1dbea70a81c92e49eb7954f64af312ff882aa4f522844e60d6e23d21f2e50f6
SSDEEP 12288:RyoKo2JRple9p7K34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:RyocDAp75SnnrFb4PM4MYgLxEVyGLv
TLSH
T1F965E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 11cdc4041c1d37c7dcb50ecbb299eac914d75898630ae97e03d451b6eaeb70d2
MD5 03218a36b63455fcfa935174878d4f07
SHA1 2aa84fb55b33814a7a24ebf720725eba2015a9fe
SHA512 feb6fbdd82b0044bf70905a0852e3a12e14dda427888aa7f812331205d39de4381b25cf1582ce556de7fe8bb5effc3d3586d24824ee3898d6204d728f9e08132
SSDEEP 49152:QWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK+j4MYPVyGLl:C0zuNIJVp
TLSH
T132A57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 115e66efd0a27ad37d9077f80056763d371ebfa43a1737544ddeb7265e49ac76
MD5 3c1ca58dbedfa827a211298dcd0dee45
SHA1 14a5737c9e76b0843649e78cbe31a47a250a8ea5
SHA512 774748579b5189685d7b6ecdc4c102ee01d22956ae5b6eaf8a4889858071811390892bd94288485284dc1ad464b7792e6f346c671b7e086e6ed246caa9ed618a
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYzjMqbe5SnnrFb4PM4MYgLxEVyGLm:uTDxR+N5YzTBjMgj4MYPVyGLm
TLSH
T10055B02EA7F815E9D1BE85798A23C502FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 51b4f2fe0096fb3f88e214c9baf73a61f66016f70d8a96f1a9fb58569815832a
MD5 27cdf34b7878d201687485980d36e0b4
SHA1 3327f9555dbfae0ede51c326fff474611cfb0b68
SHA512 e98749cbac495c3af82a23d8dacc2c0dc27d31d760c9062711a884fa801ac19819a648aea99ca72675aaeee0afad0ec4c364726975ccf8c6f081fc8d3dca6a33
SSDEEP 24576:wTMdOz0FFS+UmSLq5SnnrFb4PM4MYgLxEVyGLg:40K+UmSLjj4MYPVyGLg
TLSH
T13575E17E67AD14E9E57BC27CD6538906E67234620322B6DB0690C07A3F6BFD47939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 1cf340de33c19452a6eca628b7855365361a37e97738f1f13ccee42ae50c05ee
MD5 1f3912651f87711af9e15ffe358c8592
SHA1 8ccfd9117f9132855de0edead88309d89e76ec4c
SHA512 3ca8cef68dade9ec7360abb6245657f6958b2eabc16792f6a19c535abd7f41b648b194c297e0184888ce5b63d0fffc632f099241a4de53f5e43a15c808638699
SSDEEP 12288:h4KRK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:FR5SnnrFb4PM4MYgLxEVyGLy
TLSH
T1B855126D27EC30E9E9765270C6764288D220B832773562FF36D0E47A2F376C89875B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-103-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/788-101-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1304-486-0x000000000B500000-0x000000000B508000-memory.dmp

Download

memory/1304-489-0x000000000B4F0000-0x000000000B4F8000-memory.dmp

Download

memory/1304-242-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1304-485-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1304-261-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1304-277-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1304-487-0x000000000B4F0000-0x000000000B4F1000-memory.dmp

Download

memory/1304-245-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1424-409-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1424-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1424-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1424-116-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1552-237-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1588-510-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-499-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-519-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-517-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-516-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-522-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-520-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-518-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-515-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-511-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-525-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-512-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-513-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-509-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-508-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-507-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-494-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-495-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-496-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-497-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-498-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-521-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-500-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-514-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-530-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-529-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-501-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-502-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-528-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-503-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-526-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-504-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-505-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-506-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-493-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-492-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-491-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1588-527-0x000001E965600000-0x000001E965610000-memory.dmp

Download

memory/1768-206-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1768-200-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1768-236-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1924-213-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2032-232-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2032-478-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3056-158-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3056-481-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3056-164-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3056-167-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3352-233-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3576-479-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3576-142-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3768-240-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4008-235-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4008-189-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4008-195-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4140-241-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4140-484-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4264-138-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4264-133-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4264-134-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4264-127-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4264-140-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4288-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4288-112-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4288-106-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4288-392-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4392-156-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4392-480-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4392-146-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4392-152-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4452-243-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4452-87-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4452-42-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4452-67-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4452-85-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4548-439-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4548-154-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

memory/4548-1-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/4548-8-0x0000000002350000-0x00000000023B7000-memory.dmp

Download

memory/4620-244-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4660-231-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4660-172-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/4660-177-0x00000000005E0000-0x0000000000647000-memory.dmp

Download

memory/4660-482-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4680-238-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4952-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4952-179-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5052-483-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5052-239-0x0000000140000000-0x00000001401FC000-memory.dmp

Download