f7c8346239d0be76856789e713433e101e9eaf4b69200f03e9cca64643f05462

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Size 2.1MB
Sample260415-r9fpsaav2m
SHA256 f7c8346239d0be76856789e713433e101e9eaf4b69200f03e9cca64643f05462
MD5 b002009dfc88e463882f8a7d6aada721
SHA1 f279edebe00033b3507b9e89d46157f8b19876b0
SHA512 5bddf9c093f81c7fcbb039e2ff422af26acf81ac7001cf8f51fb3332804c039eb734ef70f53537f5bec2dc2ad554c1fc41a585e7726aa06a1c0766d2ace47f3b
SSDEEP 24576:HCf1xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+7SkQ/7Gb8NLEbeZ:WK0eqkSR7Xgo4TiRPnLWvJJkQ/qoLEw
TLSH
T112A5021278E18472C17375305A7ED766196DBC311BF16A3F27DC2A3BAE74080BB2563A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2616	alg.exe
2808	DiagnosticsHub.StandardCollector.Service.exe
4264	fxssvc.exe
4688	elevation_service.exe
4252	elevation_service.exe
1688	maintenanceservice.exe
2032	msdtc.exe
2412	OSE.EXE
4624	PerceptionSimulationService.exe
2416	perfhost.exe
1404	locator.exe
3984	SensorDataService.exe
4780	snmptrap.exe
3588	spectrum.exe
612	ssh-agent.exe
2588	TieringEngineService.exe
1236	AgentService.exe
4328	vds.exe
1300	vssvc.exe
2452	wbengine.exe
1040	WmiApSrv.exe
3936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3bb3d81c7932a944.bin	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcbb7f71e8ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006be0c471e8ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070e1a571e8ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c6608872e8ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeAuditPrivilege	4264	fxssvc.exe
Token: SeRestorePrivilege	2588	TieringEngineService.exe
Token: SeManageVolumePrivilege	2588	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1236	AgentService.exe
Token: SeBackupPrivilege	1300	vssvc.exe
Token: SeRestorePrivilege	1300	vssvc.exe
Token: SeAuditPrivilege	1300	vssvc.exe
Token: SeBackupPrivilege	2452	wbengine.exe
Token: SeRestorePrivilege	2452	wbengine.exe
Token: SeSecurityPrivilege	2452	wbengine.exe
Token: 33	3936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3936	SearchIndexer.exe
Token: SeDebugPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	928	2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	2616	alg.exe
Token: SeDebugPrivilege	2616	alg.exe
Token: SeDebugPrivilege	2616	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 648	3936	SearchIndexer.exe	104
PID 3936 wrote to memory of 3484	3936	SearchIndexer.exe	105
PID 3936 wrote to memory of 1188	3936	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b002009dfc88e463882f8a7d6aada721_amadey_elex_luca-stealer_magniber_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3800

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2032

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1404

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3984

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4780

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3588

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4652

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1236

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4328

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:648
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2664 2816 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3484
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2852 2832 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1b7649979796cf2afb00c5a4ae90f02a1cd771d22de180383071b25b37271801
MD5 cd3cee71b6de31d0cbf6830d57ce60af
SHA1 4d13a570b88af01ca244c9ddc03e7d8bd8572de6
SHA512 58a235acf4501672d45c1fb6913f9ed3cb82ec20e676c757243948286eb1fc1d37497ae1da61a52af8b0731b5944e95827e8d0739b97391a3e676800a5d67335
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnZkQ/qoLEw:m3q6HjBgqo4w
TLSH
T1DBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 a05dae3ba57fa9ae73e574789309f67ccfe6df76d14ebe5e35588a94a9da23b4
MD5 45a85376a7b6cd8af37877980b5748ce
SHA1 0e56dedc5ea63f8933383e7d44d33d774e3fca7d
SHA512 70b52f9464d79201a542a4e600de4e46a6b2c3a6546446433a7b7b8249b45306f37d2ee4713eb4615baa467d19d7097af8c64966cdc8072bab0048cd6898f40f
SSDEEP 12288:E1XLsswWkxy2lRq2czAQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:CXYfDtczA5SkQ/7Gb8NLEbeZ
TLSH
T1D065F12873E408FAEC678279CCB18401EA7378954760F79B03E4997A5F236D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7f5040138ba6f3029ded1d44093f67879765e31fd27eadb3cea9a2ea8a7f0c54
MD5 eeca5d1d09ed640289d31b020f8fc6af
SHA1 6713bddb19544de607bf1b7988823d09c56e00cd
SHA512 e9c2cdd71233e6961b12facd242124fa97d8bf8e9a98c17d0dd33976177b377e87b1e2cf8969e0ff796a5f909dececdb5dcb955007d2a1b5c7dbf2a576cb77e4
SSDEEP 12288:2XZNYVLeyUji0h90ZD0wxpGZIVubrHsrMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBo:60Le5ji0hmxMrM4SkQ/7Gb8NLEbeZ
TLSH
T13D85AE16F6748371D073C0B9C5D2A68AED7130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d1dc85de163053858bb4e6e174cc9742c89dfb1aa2ad0cde099aff12c44ad22d
MD5 b02dbedbe1efadfc2f663adebbd149d8
SHA1 29fb1b8cea59f92b689226ef2bf9ced2666e8cd1
SHA512 3d7017b2ab137f1c5395b6ba1b8fb340ff7e0dd740723371c2ca864c114b14d098d1ce717168867872d14d289f93ff708948141940d8284fbc3a473d1b296e9a
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyuGSkQ/7Gb8NLEbeZ:8/ezSC6vUzPvxHjyqkQ/qoLEw
TLSH
T12C756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3883d70e3ad21475216c2785bac586e40fd68dd29af01ff00f67a9a81a12f452
MD5 09a947a4d16814ed02cc3b0807024e4a
SHA1 33dfe86e7182f1bdbbe17598fcfaea60dee8fb8f
SHA512 06b6de5f3a6d1f50e40d2ea927dca14511fcf82d4100b17eec3c5b3a9787ad44d97c0a7ff64c08644658f24b643d27703c4bde0a570af71bd1a0640cc98555e6
SSDEEP 12288:pVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98sMTmkJR4Do07Y86gw5CtCjX+NLt:pVbqPb88hv/l+69SkQ/7Gb8NLEbeZ
TLSH
T186559E66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 468bf2e25aaeb239a5ab9c58b7e9c78571fdc467731b6debfd936fe040114efa
MD5 5a6793c9dbf9440c4879670ab899a537
SHA1 763814212b0fac856060acb2b72e004512e19f98
SHA512 c6649ee13ea90da2b1f8d08df5f42bf3332a197a077b63f8d0f65e277d4728c52ae25e4c57f8e7a3e8d62ac09f78a1d5b3a385512e8dda80c3434de3827a2547
SSDEEP 12288:ceHMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:cesSkQ/7Gb8NLEbeZ
TLSH
T15F452356915404F3D1BA1F7268FC48400DA16DCA87307A357E99FA7F9BBEC48E8AB131
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 13a17ccad553dfcec0ba1ad8ec91349dc9e98f0c531908c81e36231651edf109
MD5 eb1701e832cb2428fc44d537375eaa7e
SHA1 5dbf95111be2366e21cf476aa49a12d378bdc03e
SHA512 dc122893eec01054bed68d5c1aea64c1f3d478e3c36be7e4ef393a5377fa7e31777d69ce907b3dddbf598d16559c730f83e4a56b92856ea6fcc715a7e37ef7ee
SSDEEP 12288:2eBNUbTVO86UEMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:2JIUlSkQ/7Gb8NLEbeZ
TLSH
T14D65C03BEE28FCE2C27E4DB95A918600977278714B21A3CBE165C30EDE235D45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 abd739be06d053e5ca8b59e2274616cc056c5309cf363409a1b623660437146f
MD5 71ad44212a0b8ea365cc4e7e7194101f
SHA1 2cce94e7aad569481565603a8b393e6bc0f630ac
SHA512 c15b8578d14a05f1bcae6866c35879482d405a8e15c079b5af9be59a448edcd037ccb386f8c70200b62bcbc68b052880a102b9c78f18948d87f72ce58a7cdd67
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:RQvGAdlCEL8c/yRNw5Crqo4w
TLSH
T132266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b413a23aa19536105b217f2e2a2783007702e4f46fc91f4ac5ab4ae55797118a
MD5 0d3f612ee4af750aaea5ad6bbf056c94
SHA1 a22c64db54890e8f676cc87a1dff08b22eb65f33
SHA512 52c025b937dcb20dcf760401ec6ee5d630579ddcf0bf2b01c4a0cc812918730328aa31f2715991a3886bb63ab5fea2e0d8fd3123291e803dd3a0052531282a20
SSDEEP 12288:ZAwSfxL/2Dc3eDLLmt0LDQewsAjmMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:K3ewsAjTSkQ/7Gb8NLEbeZ
TLSH
T1F675E031FA74D032C2BF0DB21B35C706187DB9604B612AC3E3E88E9E59745D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 23e325d16ccb5c3280c6eb801c5a49664c4cee9acae7799cdf946c94f991c4ae
MD5 98b6550ddcb9d3c361aee173b45b4299
SHA1 37cc7aeb3d8f09d42fe77400f30c0c0bc4bb22a8
SHA512 95ed85295e1b0b890408dbc4eb4756f53cc521562a9c074860a0a4db8aeab5a207111ed94d6a12a9852cb26b733059fcbaa1aae09ebadd300ab6ccecee882ecd
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa:aUEtQevvqc2W1cpV2EI32a
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4a85f4ddd4c6dd424a585ddf04f6f41714cecd084f2e456e0c8f1efab82c0a7c
MD5 b26483223c2d9511738f9ac0734bb385
SHA1 e6c2e9d230fef6c189229376c01ec15d9c3a3bb9
SHA512 ba980d2f8e75851a77e53111d5103e83711c6554573ca7a0110e95a10ccad3dc919a23e2859928d6e663eea057ff219cfe913b6fcdfe4bfdd63d792ba6c7b98b
SSDEEP 49152:eCbRquA/m2yL5zifFiV+XenmE3/zukQ/qoLEw:ToqHVjnmHqo4w
TLSH
T113D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f554ce63f531f58ec061902b7b8e9795e77097a80e582a7107d5fd8745eda945
MD5 8c2e538094598206a5c8a97a89b247ba
SHA1 66d2c559372b17c66bb8ccc6a138d38bc07bb013
SHA512 d992e38aff29f4f9663b0048b500d1c495c1e06f5f300730e38431c3bfe145c618514336315dbaf87b95b541999b022ca55a5fafe2ef6359e38d5148d15e60bc
SSDEEP 24576:DAhGLJIFoiwtA5l7S53iSkQ/7Gb8NLEbeZ:DAMyFoiq57kQ/qoLEw
TLSH
T1FE359D81E7F945D4F5B3AAB899B68570EA76BCAA5E31D20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 27e0e4fde41b1185a84745194bc154ac94185b715125e7b3d7791751a32204cb
MD5 91a96e3a723b8d19c57cb6fe15c61493
SHA1 c7531b8552c66d7dbad84c110518877c65000277
SHA512 648ab76181a44a4142819d65769aeb34a832c677640bcf0bf51ade95736240975a25e40d780e8fe7305be110f72e5857539908453d6701e746b99985f0e26234
SSDEEP 12288:zmw5HEjsChN8BFgl0WDm+C1MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SwuxOWvSkQ/7Gb8NLEbeZ
TLSH
T16765F14A72A40CFAE56746398597C431E7F2B8462B31DB2F1760C65B6F37221BD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 a2e4f9c8fe339567427cfc876092a2b079e165e36b1295d32b03b1c74d94a89d
MD5 ece539a880e1bc43fe102f3b11301407
SHA1 41516940692b524c642c22ae7a5e5453d8c2fe33
SHA512 8c033c3a1869d9117b0afcc1848b21acaf862b7d8b43dbdadeacb03899a6c0cf03763c3b57c54c1d603ab2dbebe6234ab652ece2ed8c86b38f3a0c7a7d497428
SSDEEP 12288:l4Z1Iy2MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:KZugSkQ/7Gb8NLEbeZ
TLSH
T1A155125A32E420F3D1A75A399CF449009BB27887533163DF2A68826B6F77DC56D3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b203d692b7bfe30e266185d8cdad7ed949236de133f6e56908bb6b91e50776e1
MD5 10f8286f524de1a2df82fbe9836089a2
SHA1 d944bd508251a05b815739250e0b97acce2386e2
SHA512 51158245da4eee83c061c96f4325bcbbce4c4053bef28d05ddb6dce3d9a5863c0d36db17b19ad30ee203d5b590add2499987cea1923fcbf589f1575374cb8028
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:dQRQyi36YOcPQLvw2gAf+PN30qo4w
TLSH
T154667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c2087d3576376cb0d7c9642610f9381149f212a7924ffe21c4386c1d9b34b8c
MD5 34049fe73aa65ac0e86937f57ea8e962
SHA1 02d2fb04cbfa10606c5f6c24a043e455f2041669
SHA512 7660b9b8d0101fb7bc88d3bbc9b8db79a847861f53372ceff72eb2ce395b88d1be830c13d41d44b407ff8774d4cc5137b9d0ff539e6c5a3fe9f242b93e2c84f7
SSDEEP 49152:tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:kQRQyi36YOcPQLvw2gAf+PN30qo4w
TLSH
T12D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1c6c05d87116a76379f6e804251a6fdc892fdb6d41e563c1ab764b4c82ab953c
MD5 817f43e1fe015a44c7bab0db4176273d
SHA1 b24e048e853deaae8ab6b74504ae639a04b6d015
SHA512 9c4fb7e96b62279f0761c617e5f9cd1324dbe282eb3d265556fa2b6cbabd33dcf5354c917d45d1aef052935750bd6949a897dd3f62e56151e784f15567ffc2ac
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0QSkQ/7Gb8NLEbeZ:f68Qg55nhheWu7PNU3/ekQ/qoLEw
TLSH
T111B55A33B2F200A9C44DE1769F4A872196D17C758FE0E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a6ba5a9e189e6cda704e950066b01a2e5cb807be80cbddc04f1b5fd8f117af0e
MD5 51f8fb7834e48221472db771249a30ef
SHA1 bba15df53f45b2eb8e4d568895febaaf28ffab7d
SHA512 f48f514c6e002b49e89c419a5e77f4ea80da7de48979415d6667295a3fddd44a5fb2e4dc8625ed084b22a1592ff992c92ff82f6d1dca92ed3a1b422e6135165d
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:2y5112gYy5azzVvL69nLKnhZFqo4w
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7348b7fdcf403b3f2fabdce5b51a01ea09b754ad2a87253d767b62010c82be5b
MD5 d69be600a8f923d95205590e3e473eee
SHA1 9d531ca4f08ec6db31bafdbbea21a986b51e39e6
SHA512 eb7051da0ebecef737167d357c6a14844e68d9188b28219e23f8a6bbad246b204be433199a0a5ca2bc84660d56787183c647b11832b0a5710395a202e2680e6a
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glskQ/qoLEw:Tu6JmVxd2d8qo4w
TLSH
T19BD59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 56fe03c002c141cf603446daa1725a26260e2e49fdfb2c18066b89dc6cd27ba1
MD5 a3cc2ebcebf54c84dee85be558c80d6d
SHA1 b8bbdcf9a25128065a870e98f1c684dfa0f72079
SHA512 f58646a2c1d3578ce72e258048e31f9cafc081be5b56136d5a02401a0b2f6261d9663d2e24e8f04089b7bc5a8a44e23a622cd748a2632bcc987af7e3167615e7
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xIkQ/qoLEw:qmifPbRHqo4w
TLSH
T1C2B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 311f35f0adbdfe27558e56124eee938467a5befc2a986c54ab57d3bdab90d43e
MD5 c9d947f26db3c3aa5bf954694fe0d1d0
SHA1 b961afefee58d1dc76ab7487af8dee2f037cbe43
SHA512 c89d1f21d9fb2cf400797952e731a33b6dddbc304e676579732e8139e2f41ebf595e9461a032dd110cb5bec30ce6c5616fcc1be119e7f61757e57f0c347b139d
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqJkQ/qoLEw:35dKTi615qo4w
TLSH
T12CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3c591ae0267b4f38669baad097030501ea2cdee3ba50c0decae4c6a6f7277f31
MD5 87775e5d9776ae9eeffe4d314fcedaf9
SHA1 672e4b8a1b3d64cd0eef09d3a94e58a3187b1fce
SHA512 d1baf174d0062c1ccee637729669bdba648554e8830a2ca96659bfda779fc884e0cfa101af787a38f47e6907dde7bd80ee1c5b5bccf47b4664d0ba31b8872580
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wckQ/qoLEw:fX2iyphDqo4w
TLSH
T15695BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f777f5018eff643b87f692f33fdb85b79e589557d7b43a84a2c4ed047ca1ce1c
MD5 a551515956bd17d6f7230b451c139e67
SHA1 16bf93edbb4152651c8b87439f182f25ea0f36d9
SHA512 31defdf3746ae8a24262f810cb3497764c18bf284c2413b7a0fa3c8d63e33bdafe370a4750e438f0f89ea37424d0c660e22c4e180e6a0a5b4badae0f3d06e26e
SSDEEP 12288:E/MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:EUSkQ/7Gb8NLEbeZ
TLSH
T160452359A0A405F3D0661FB258F804400DA569CF9731763A7F9DE53BAFBBC48B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6da8e128faa45cc972e932715226b31a4479b59907d5b3aee233f1afb0216b19
MD5 b15a2c573bd4e9a755b34ed2f8500924
SHA1 46d2e4c8a40f003c51af05f4dc03aa6a3ac5b385
SHA512 8e03f0b872db3dc7072b74f0228a51adf78c7881b1a80a54007817c284c989b8a113e0b2f33f8f6b12f7be1a576ece23cf547a8e48ad8da0952921e7ba0eeec5
SSDEEP 12288:hiMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:hnSkQ/7Gb8NLEbeZ
TLSH
T1CB452359A0A404F3D0661F7258F844800DA469CF9731763A7FDDE53BAFABC58B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c4d521cd239a255a5dd1028b1718bbd736b091f2463b738e7dd3111ba8bc61be
MD5 72489701fb568f2132b5e04976a6cdc0
SHA1 0784a6e09de6d0cc8f8c19ff411b315d6bf832b1
SHA512 3f71e51c3e0af3d510017acbfe3c66a80d08dbdc8e34a726f45bc214e685d74f2ef85af30b25ac2621fd64a15e1a3b1ce72484fa1977ac30d990dffaf549a5f1
SSDEEP 12288:mcMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:mtSkQ/7Gb8NLEbeZ
TLSH
T13B452359A0A404F3D0661F7258BC04400DA469CF9731763A7FDEE53BAFABC48B9AB174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e5db5b72a4fa0f8543322e3da16b3cd483f5f5d50f968a98cdde7532daef3b29
MD5 f4c96978880772d74ea33b7edf4445f8
SHA1 8c229ad9517181ba08cde830f71f0796aa3a4348
SHA512 b40add50cf1464911d5589148f23ed06089880af4afa3e01441d11767225ff5bb62d4e56ee56a007d3747657b2c082dde6021496f0d1ae45527d2d85b24f4519
SSDEEP 12288:iVZMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:fSkQ/7Gb8NLEbeZ
TLSH
T13C45235661A800F3C0769F7688B944405AF1BCCB9731777F7F44892B5FB6988AC7AA30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 61ce4dfd887ecc7af1a35d34170cded447494b70bb8c464478536da04d032fa1
MD5 217f271e4bb46cb65bffd46d010dc024
SHA1 0db8b97bb3e14fa393c8d96b25c77b15295485f7
SHA512 7523ef7dc6236dbc6e61230d146f115fc6fa60582d4e5897b4166d5dcff0416ffdf8041af736dc51ee9430829e5d79125718f6c0c13e160a0bc0e518cc8224b1
SSDEEP 12288:6BMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6aSkQ/7Gb8NLEbeZ
TLSH
T135452359A0A404F3D0661F7258BC04800DA469CF9731763A7FDDE53BAFABC58B9AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ce468c775b4702e470486e46ae56e4a4c2904bc962bf7f6128955a58dc4b0218
MD5 c0767a0db490d71e3809fb87fa3827f4
SHA1 71bd2f29cbfaf2580c1bd2fd36331a94659874af
SHA512 6ba7eeafa5034a0006671e16325d9286b25dc8d1d87593c4002ea9c269035690a8a3c98af53e3768dfb277b3f1ca38bcc323bd2e2ba560ded342d17a91f6a4d0
SSDEEP 12288:V+MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:VbSkQ/7Gb8NLEbeZ
TLSH
T1AD452359A0A405F3D06A1F725CF844400DA469CF9731763A3FDDE53BABABC58B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e0d7ed56820c8976fc5a65290c1f60d39e383c110b9c59a5c564408006aa75db
MD5 5d756653da9cc36e18ee503ef1110600
SHA1 c88c1a7fb4955af59b080fc31af769c071aac08a
SHA512 471c1ffc01a18ad8ebf61a5a204600669718140f4d658abf2798899a0d7150c70f79f9617dbe9c76d5d75e42cea8bde7283559208a7ce54fc6996e9d2a9aa508
SSDEEP 12288:TqMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:TfSkQ/7Gb8NLEbeZ
TLSH
T13A452359A0A405F3D0661FB25CBC48400DA469CF9731763A7F9DD53BABBBC18B8AB470
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b6b871249da8d6a7a2ee7c350f240e471a70692acae445610345647e6075b8d5
MD5 086e9b02feff6552fc5d8384e2835cb5
SHA1 df0a7e083264f3ff2836f7f88419374b14a26248
SHA512 ce297d38fc3817cbc30debcf968ef2cf95a1355672be55ee6da1b7d9ba47e32b7eaac8d379af0fd627ae01a40a08ac0961cf6403d96019ddaf630f830d6f79ed
SSDEEP 12288:yiZwbQzzFEoS2cPvyCMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:VZM4zFVSOHSkQ/7Gb8NLEbeZ
TLSH
T14D65F195B39008F5EC67863EC9658805D6B27C5A0B70C62F17E8362B5F737A01C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 56677a8a48d55fb128c524b4d0fa5c59e6beefb4c42342aadb47c479ac895f82
MD5 882b4a307dcc82818bf6eef62bc68abb
SHA1 90ca8977ecaf93f8d09281cc9bd92b38e8867fa2
SHA512 794f8a95c899bf632c8c7615c774f552b9ce9ee6a2a29dfd8bc348fbdb4a61145908873604ae966a1fdf8b80f3d07a2a598701d10647ffe00cf7ed859ac23183
SSDEEP 12288:dTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:dwSkQ/7Gb8NLEbeZ
TLSH
T150452359A0A404F3D0661F7658BC44400DA469CFA731763A7FDED53BAFABC48B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 148555db6e1598d341ab1e9966c0a530add5b1a1ec866ca6486bfd2d2e329cfb
MD5 5ebfc1f3f3ec028df3343036cf085950
SHA1 fbc7ac386330251aefcbb44849b5b1c0822e6308
SHA512 31abe35ade7be376daf09dd505119302924b7e947fa91521489506f12c6cf58825f35ba2b7e0cbbef76a8daf8f1b796c5d92c3ed84142c8f1b1d82bd552089e9
SSDEEP 12288:rXMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:r8SkQ/7Gb8NLEbeZ
TLSH
T11645235AA0A405F3D0661F7258F844400DA469CFA731723A7F9DD53BAFBBC18B8AB174
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 58743c21600d4ea262a5dc70db0f6717e212a977915a4a57c1dc1ef7847167e0
MD5 8402ca607b8a8a0e4f8db93c1551bb3e
SHA1 88313b361abeda44fc2fa75951405e85bb929567
SHA512 3b4d702059daa0356ed9b9c2f532b69e6c95de4edd50867856ff693cc637ca4c0a86b6638b13c1cd0202832b30e3cce9cd97742ad87f6eb26ab434d63fc6488b
SSDEEP 12288:LyPz5L82MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:mzyjSkQ/7Gb8NLEbeZ
TLSH
T14655024772A120F6D077963988A50901F7B1B87647309ABF27A4477B2F27690AD7FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c4b84c3f744c79f3647bb380a71bee86098758a084818107f773f5b8f757c406
MD5 9f95c81c9a5fa93a4802ef7879044984
SHA1 37426449d1a8ceaa3a4b2cb8d50f54aee74f01e1
SHA512 16f8799c11fe1480285873560958bb47639d9b7b53f876058cae23cf4dde63ac6998501219d61f6048c3970efce486a9190790e816bd5ea322be9c182f9c1421
SSDEEP 12288:6TMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:6wSkQ/7Gb8NLEbeZ
TLSH
T15645235AA0A404F3D0661F7658BC44400DA469CF973176367FDED53BAFABC48B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7855c2be2d7a802f2b9e4840caeb32dcad8da52b67dd192da6f055f1f02d59c5
MD5 a89d7e1b362918d32dae8823e4d048dd
SHA1 4a8a20c524918a95b6c784759a3dd726aedcecc9
SHA512 26e44c9e434e090b17b3b7199105305cff5f2f7a6dde549d350dfa3623a0d042d41a2cb51d3440e4ac2add3d628c1583486d3810f3a9e249026c71d1a37917af
SSDEEP 12288:oTMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:owSkQ/7Gb8NLEbeZ
TLSH
T1A5452359A0A404F3D0661F7658BC08400DA469CF9731763A7FDED53BAFABC58B8AB074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7c2cfe77c2099668b971df85f99ad125f57b4c9864afc662db26cecd6675d2d4
MD5 60417577b873f1c1a9cda03918602c24
SHA1 8f0733ba33788efaeba448a39ed9773360071899
SHA512 48d821bdfa5c2892eef88cb5dfea339405ba830a97648331d981a9f2efff70a2bdc4a217ae67c65efd89297ece662358c7bf48d1f39470d8e3908ede2d1b9198
SSDEEP 24576:sCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAxSkQ/7Gb8NLEbeZ:sCUxPTY+8Wg2lIL8lrIUJLWwzkQ/qoL9
TLSH
T12465BE1EA3EC0896D0BB813589518A06EB72782E1B32D6CF2160C73D6F67ED95E35F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f5d7d54721fce35eb3a61dd3738b32d6a9b7333c2440593be37dd4ed09c58389
MD5 fe37ee2a22c5f9fc0bbfc6f4b6b397c2
SHA1 f14b328accf7c58b5def930b864a77b1984185ac
SHA512 5a20473f6a3738d86d2b37f2468c8b620787e94be299a9f3c386318000f45fd390a82c2b419c3f527b40098ea5ecf23a78c033fa401ae67275697a012a350988
SSDEEP 12288:6ysfDMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:egSkQ/7Gb8NLEbeZ
TLSH
T1E155F109D29802E5C06E6675CBA54940B7737C5683F1E3CB27C0F53E1F7A984ADEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 680a759c9250a96015fda614a5367778080104b6a14d67199ee5ee000ff6efbd
MD5 95b51888d5d7b056058ff94d631f1ebe
SHA1 8098be4d20b1db8bf79e1c242e468a49d2ff1790
SHA512 bd86dc95b82c8ef53824642335a35c7582b701cbbc4ceca51a77ac232a768a531752c8f5ba234b84ae3cc8330ec7c1762c24e5fe08b47865844d0a2048a91c1d
SSDEEP 12288:D8MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:DNSkQ/7Gb8NLEbeZ
TLSH
T121452355A19804F3D07A1F7118BC44100969B9CF8B30B5F77E89D27BAB7ACC8ECBA525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 436ddd99a6eb0f8c62a4d94f05e429d09fc8db1473eac5d2fcfd5747347eb19b
MD5 83ca861c181f9485c8b0f1835762f240
SHA1 6895861313bd48d353e6a1ef6063996093a1a226
SHA512 181b2abff847aba98103d75f753ff1f31403597cd578a11f2ac8e5089e0c7a332b06376b60509415d55f0fb1892cacf2a9f55e1fa9659cbe8c0770905e5d4a3b
SSDEEP 24576:W8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCzSkQ/7Gb8NLEbeZ:vRZwQCyiHiQEaiPnMRkQ/qoLEw
TLSH
T14D85B01E62DC46A5E0BAD278CDA74407E6B278164731A7CF1190C27E1F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 06fc16dabcc57cf5ff01e54fd4f2ca17f5721b47c9f86e8d4a564e87681548d6
MD5 6186c114899b54c425303a67e8bede5f
SHA1 6e04351fcff5c31ce11ceb54887a9471680f6de8
SHA512 8dccdc48ea8bb3b99d0b4055ac13ffa733ed4e32ec156983fa44fccc7e112b845e937e17930097238e6d09f38737906b1279b65f5f1ec9f7abedc9f4fb15ec45
SSDEEP 12288:3bxA1U7KMMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:3bxA1UGdSkQ/7Gb8NLEbeZ
TLSH
T17D55122E61AC14F2E1769A3A88E58001C771785A5731A3EF25D5C27F0F3BDE8AC36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8ee131d8220a64f3e1d3c4bdd50d85ff9c1ddb6428c83d1fc0bb7fb0fca15ebe
MD5 ab5dc60619f34c9aa1b8fb9bafea7c79
SHA1 b96929b7fd485162ee9f66f7f6fa228101fb438b
SHA512 5a0e4de629bb0b2c90c6b9c4b73ac54cc719d00f0ec66a8cb25d6e95a9ad668a5ec0dabada5c46c84827e11eac26053d10b7e819e9e94e72f9370943e36158cc
SSDEEP 24576:PjsmP0yHaqrVqHra44KDzMsrnSSkQ/7Gb8NLEbeZ:PjRP0yHfVqzlAsrn7kQ/qoLEw
TLSH
T18445BF2EF2B910F9D4AAD236454107B5BB71B42D1F209ACB0170C635AF0AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 f7a3ad6fbf88177dbd122dd404e72acd01d6dd097a87d7986205f7982dfe236c
MD5 4ebc80ad7790287bbf283b2078e2f759
SHA1 8836b9c0c329a5b9459c87fe45aa7937d136356d
SHA512 694497ed8dc4b9030209674e6db71a3c07243c703c7502b2cc67b46321a99d068082c8ae8971654715eaaa6db4870e3c7b99a529dfd7ec2f546254adc360c1ab
SSDEEP 12288:IeMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:I7SkQ/7Gb8NLEbeZ
TLSH
T118452359A09404F3D07A1F7618BC44401DA479CF973136B73E9DE63B9BAECD8A8BB120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 6effedbb8c3ed640a070a4583031437efd283fbc50b89ddcd24a894a237094e0
MD5 119339753b33ef5892b5b70fea9151e7
SHA1 a201640c380dcf6b2549ec19f0a236574f6add4f
SHA512 033fa439adb24b6ad18f747609cd9e6ce0b986b3e54a9cbd347228a88339f3ba42806298d52dcf37d494eea716dcdb96ac20ac3dea7afa486716440b7790351d
SSDEEP 12288:FOb3A4LWO+vAYFTQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:CTLBUT5SkQ/7Gb8NLEbeZ
TLSH
T13675F155F2A400F5E87B923CC9B68912D672B49D0320F7EF17A88B661F536E54E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 f548cc1472462b427085a6f474c7509fc5509a0300940520dc384cb45b4f1562
MD5 4b1760464f2aff809702a2f71363531f
SHA1 4604b65fd1b06f484b5c5a6016c9d8a5d1618f25
SHA512 fb8a9e6e4a7d9cea0ec53c21067539d2a54a0a57bd5db6108c728cbacfb4b286fe75e95e1ee01f446f83ed0c334f40ce08a9138667a8c2e3f4c6e045ae220b5e
SSDEEP 12288:z70Vm5IYNvUyBpvMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:85YNH+SkQ/7Gb8NLEbeZ
TLSH
T11E65F12E62AC08E5D57BA1798AD28105F67278961321A2DF15F0C27F1F17EE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ea8ce6af709c8335a6eb54a712c3b278d335181f7e940b6d8c536bf2787cafc9
MD5 15b3297c6be458c3998fa066e4e15891
SHA1 3e95a3d8574dd31b7bf917949c52800e1defaaa0
SHA512 3111024ea5748430ea9ba1b986380b384fe6989db831fee8b1a5d6a628875267b2fd5c5c1d725f466a9155b1a3b9bd6148fb4b848ed8b95334587f1cc7ae9dea
SSDEEP 24576:qnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK6:qnXoJJYH84VVS6AmEcJas+cHBjSSKHPq
TLSH
T1B165BF6EA2BC04E9D5BBD17DC5C24506F5B178621331C6CF026082BA7F27AF56E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a2305ae6c0517f647e228857d8fb078cd98662f9e83489a65864e0864e565483
MD5 e843e1e864a2061a3898123da38723c2
SHA1 dfc84f8822f30cd9b06ab043939354c0fd6ce29c
SHA512 d67b8ead4cdb4fdcb44ff74453393f0015d648d48887ae003b7eaf879ea355c8da9426ef393881764eb1bbda719a110a5c82c906ff9e3ebbb6bbaf941c20ac0f
SSDEEP 24576:sv7Xbxd9Tuycf8M/TYlSuxrr2PCMSkQ/7Gb8NLEbeZ:sDLL9TuJ0M/TYj2PmkQ/qoLEw
TLSH
T1F4859D5EA2EC42D4E07BDABD85B79046FAB2B855173091CF0291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 752da55cae4021a5986c1f05f746603f69988220ba312cd0b39fd9c4e2873490
MD5 ad717883f31f2b9f48c179313fe1933c
SHA1 6f1c411c36d420d997f8e3fe4a68c1050e15c20a
SHA512 c8501ea461655351419a4c2491d76955634e44f15fc48575061c22c806c9028fbf1aa52712ca0ce77ff69bd2e30aca572dc0b01e7ae81d9ddb51b019c74b1cd1
SSDEEP 24576:wegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w5SkQ/7Gb8NLEbeZ:wngOJOmPOHhckQ/qoLEw
TLSH
T18C55BF3FA7BC15D5D03EC17D8A968816F6B1782603356ACF0560827E5F1BEE46E3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 7c921fc03496e773c4a9c1562bff4f67d376581907b56641dd145185d539e4f4
MD5 2dd3aac714860457fd509308f7a285fa
SHA1 04b1665f279cf7852d77e7bd0e5bfae2d3386fa0
SHA512 af8e62bbe0587662c4e6bbf6d77d3180a36dd93a9ad1e22b649cce93852ef7a8229397a1d3404fc1e5fdc5e6c3643967814d5188986fa16ef5d6a3dd2c0aee29
SSDEEP 24576:ELJnJiTk3R3waE4JrObSkQ/7Gb8NLEbeZ:ELJnJK8R304lLkQ/qoLEw
TLSH
T1D665E03CD2A810E9D4B7C2B4815A1A56FF31346D2B2179CB29B4D5353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1a9476a12ed29b0dee52cd2bb2a6a8d4f8d1106b54d1e6db0b70c2ac809ad2f6
MD5 00e7f159cd03e24522f627eb8bdce252
SHA1 1f3105ef6694be207c391f1e71f4fa0c5f6bde0f
SHA512 65831ddff36051fc7da6aa83fa94623b30c02062323d7cef0a45cc9c0fc3ccfa479971ed91dfefac6b5ba2938df37b16ced660a7efc923ab4f995fd74b3d4591
SSDEEP 24576:nA9mqCceDQncA/BmlvLto8cFVr9og9P/Z6pBSkQ/7Gb8NLEbeZ:A9mqCzDScAZmlvTcFg8Ph6akQ/qoLEw
TLSH
T1BA955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 c3faae1d6cc427539ebde882fb07474e1f5bb84585384bbe26e26d6bda5edb62
MD5 a918191df98998afb4d169e70139b26c
SHA1 e3a7a596b44c08de60fc565f94befda8fa4b1cfd
SHA512 22413dd1546ca641ab27f798c9e882b679b2dc29c28e71f3194a42d79ecf5bf00b214ee02ec567fb0ed8375d7b7c9afef19f4af3959707b43fc3cc55f50345ff
SSDEEP 12288:zlYJeXm5nkEUuEgMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:zlYJeXm5jUuEJSkQ/7Gb8NLEbeZ
TLSH
T16855125D71AC20F2D13E967A98A54800D7B1B0A6132173FF26E0C27F8F67DE56D3AA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 ee976ecd108a8a9db2a89632c0c370ce3968b843891510cdd3173cc9d8129304
MD5 a30a52547afec6fffe888cad853911cc
SHA1 025a978f526985c55ff7ae3552f9de8e3c6f0784
SHA512 fe3be1129157ffda71bb3da8a9749d3c28d1c1f2beacae99b830320f9fae8bcd4d79cd2bf8271c523ec9f6a840f22bd7eba80d7d8aa9fd2262fbec7e26d32223
SSDEEP 12288:gTu6kyJMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:gKtyySkQ/7Gb8NLEbeZ
TLSH
T16D55120962A410E2E5BA0B399DB640904E75BC658B3063FF25D0E63F6F77AC4AC75B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 036e259fa6d6cf23b6a10b8911d03acbc67dae6dbc0c5f9d2a11a37116d1bc5b
MD5 44c82c596824a8f4040ddf74a4e4d520
SHA1 181ee552978109643c8b6112449e566a66fd20b2
SHA512 65d6554d3bf0d5de3375b1a3849fdbc744a1060426b83063a067b78507e08af117a452ecf3971f5374d74f6908de6ad85168661b631270077ba7ada85d3dbb7b
SSDEEP 12288:5PQMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:95SkQ/7Gb8NLEbeZ
TLSH
T1AC45235D60A410F3C0761F7658B9084009B5799B973136BF3ED9E63BDFABC84A8B7920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 602b314723e11837849213c4fe8d24750cb1f1be1e11e356cb3e7cb5b4039434
MD5 b85c03e81aba9d66c9388ac4187be414
SHA1 18fe47cf7cf40c1f28514eab073c2103a8e20e77
SHA512 e2f4c0606e47e47bebb35002addfe7f39ccd143dd94322c839e879f2df63a2ddf2b698a21cfa453e4b87be62441bb91fefdd7b73504a82aa77ad96630dd72ab2
SSDEEP 24576:jC+TyQIu93VAumZr7jmASkQ/7Gb8NLEbeZ:j/TfIq+YpkQ/qoLEw
TLSH
T11E558D1DA7E91DCAE176C675C8A34493EA33B472137196CF2044C07E499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 689eb6f84d730ed05d4b17d079153236bb8e591d117dc2df538c2ffb48922c80
MD5 eb69b4046ce2e54293112276f427ebc3
SHA1 830d908d141080c9f475afa7cfde918bcdab88a5
SHA512 b6beb3f55c5f428f99a48976945cc85f69b52d8bc1df18a7e5a6a6d85ddb6007645a5ce0d7f61e020b9a7954cc79991ffae1cb49a44f4d91b04d63ef0657cb28
SSDEEP 12288:TcyrWOstaa3kcs0MTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:SLQikZVSkQ/7Gb8NLEbeZ
TLSH
T18A55F10FB2AA00E2D0A7823C88954141FAB37475572267EF16D0C77E4FA75E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2292e8042c54291898e4423591dc4a3c68a973403054e62976044d39e2f568a5
MD5 d17a792b192b3f21ffd533a189cd8f00
SHA1 e5ff2f54386351dadf8ce6621ebade48e5a31ac4
SHA512 c77dda430212d5ed6925bbdc4ee671f2b2ed9fb44bf1b91b21404bf805ce1bd0397193262d67ef82e05e2cf57ba60c12c18e7d234d13065d2476e4def411941b
SSDEEP 49152:FpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPbkQ/qoLEw:mpC7b4+80GTkmqo4w
TLSH
T15AA57C3DE2B800ADD8AAC775C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 21dc76fa8f679bed519a5d57729a90f0de5bc01ccd5e9718f4861249634ad2e1
MD5 8ef5eff6534d7dc67439bd894db65e46
SHA1 092a51237a95a291b30fe874b43c788fdbee31fb
SHA512 0755c7a1eaec89a5ea22fc0b36ec30c554a09b6536b6fc06312a2fb0304622f13685f149d28641309c15f0b3ca396f97ae365b02aebf3cd6c7b4e6032cc017d3
SSDEEP 24576:VSAwJPE1IDAo+4Kt+l44135UQ6SkQ/7Gb8NLEbeZ:VqPCIo4Kol4/QTkQ/qoLEw
TLSH
T10255AF2AA6F946F5E17ACBB49663C501FB727823133163CF5290813E0F169E85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 7a62412de7a47e3012d245d0a2ef6c47baf05c83d4bdbdb8f3e431f8709bbf4c
MD5 374d16f76b6a3a57f3f32ed6160b5019
SHA1 85b0521840dd1c816ee5399925ce30c05316cdab
SHA512 9a013ce5d894b7ec8c004b9f03356b5585b0620bf191fb1c8817df16336f3741dfff8dfeb935bf24a1d0b8987e4887497331c05c26a88fb6e51009777c8f6825
SSDEEP 12288:GSsyLCFBoPLCRyh6NQ4txMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:KyLXPLca94tKSkQ/7Gb8NLEbeZ
TLSH
T13675E13ED66C04F1E47AC27CD6A38906F672389D033166CB19E4D17A1F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 d0469fdd68502538345b59e0847bcd9383076d4b1b3ae62bb9d638a3b77f878d
MD5 4a0d4cb3ba38dd7ccd82a9698bf5fa8f
SHA1 03eea7a3f496df812f74c15368e2ffff22bc9fe5
SHA512 0c471dfd1c6648c22e1d61550176553dafebc615d27b9f00b3b5a2bf22f0a9d145c3569f9e78eb388f39c8fcf1711ed88544d50ff0edb5b87f91dfa27939d698
SSDEEP 12288:s9lyvj3IkxjbBzkMTmkJR4Do07Y86gw5CtCjX+NLuFhNpBeZT3X:sWv8qjpFSkQ/7Gb8NLEbeZ
TLSH
T1A155125E62E414E6E07A4B74A976801045B1BCBB1334AAFF35C8D57B4B369C4A83FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-443-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/612-187-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/612-194-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/928-8-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/928-74-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/928-0-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/928-1-0x0000000002500000-0x0000000002566000-memory.dmp

Download

memory/928-473-0x0000000000B80000-0x0000000000C3F000-memory.dmp

Download

memory/1040-272-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1040-262-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1040-268-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1040-480-0x0000000140000000-0x0000000140159000-memory.dmp

Download

memory/1236-221-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1236-212-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1236-222-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1236-218-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1236-236-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1300-246-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1300-245-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1300-475-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1404-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1404-149-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/1404-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1688-75-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1688-88-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1688-82-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/1688-98-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/1688-84-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/2032-89-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2032-206-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2032-90-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2032-96-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/2412-111-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2412-231-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2412-115-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/2412-105-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2416-129-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/2416-259-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2416-134-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/2416-136-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/2452-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2452-479-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2452-260-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2452-250-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2588-204-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2588-207-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2588-198-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2588-472-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2616-113-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2616-22-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2616-13-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2616-12-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2808-126-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2808-26-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2808-32-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2808-36-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3484-492-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-496-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-491-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-494-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-493-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-495-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-486-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-490-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-489-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-488-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-487-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-485-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-497-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-498-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3484-499-0x0000019FFF490000-0x0000019FFF4A0000-memory.dmp

Download

memory/3588-173-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3588-364-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3588-179-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3588-182-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3936-303-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/3936-481-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3936-319-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/3936-287-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/3936-274-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3936-283-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3936-280-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3984-477-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3984-150-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3984-282-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3984-478-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3984-151-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3984-157-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4252-71-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-63-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4252-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4252-69-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4264-38-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4264-61-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4264-59-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4264-47-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4264-44-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/4328-232-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4328-474-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4328-225-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4328-233-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4624-117-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4624-123-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4624-127-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4624-244-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4688-181-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4688-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4688-49-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4688-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4780-162-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4780-168-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4780-171-0x0000000140000000-0x000000014012F000-memory.dmp

Download

memory/4780-328-0x0000000140000000-0x000000014012F000-memory.dmp

Download