Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
- Size 2.1MB
- Sample260415-sdp41sax6p
- SHA256 7cdc28dbe2b055b2619f81842f173a1518d3d06452dbaca564264333724f6cc9
- MD5 b39e88293dc52892457d834aa524eef2
- SHA1 cf0e4585d6170ff1897f93f7a61aa521b0c12677
- SHA512 cec97b7ca397b1d87f81eb3ea57e5b87d4b0a9c28e0fcb74f6c4d4ca521545380d61c9e050ed294d7408c05c2432d3fb2eea2fae8bf71e7f5cb837a106e8943e
- SSDEEP 49152:yK0eqkSR7Xgo4TiRPnLWvJ6fJ4klKXnp:yK0pR7Xn4TiRCvJ6fJ4k
- TLSH T103A5021278E08431C17375305A7EE3665A6DBC301BF1663F67CC2A3A6E74181BB2963B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 3656 alg.exe 556 DiagnosticsHub.StandardCollector.Service.exe 2776 fxssvc.exe 4900 elevation_service.exe 1748 elevation_service.exe 4316 maintenanceservice.exe 2332 msdtc.exe 1312 OSE.EXE 2188 PerceptionSimulationService.exe 3356 perfhost.exe 1768 locator.exe 1296 SensorDataService.exe 5032 snmptrap.exe 3868 spectrum.exe 4616 ssh-agent.exe 4732 TieringEngineService.exe 3864 AgentService.exe 2924 vds.exe 2260 vssvc.exe 2056 wbengine.exe 3296 WmiApSrv.exe 1404 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\System32\msdtc.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\System32\alg.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\vds.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\3146b583b6a01835.bin alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\locator.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1aa137fe9ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c4ac5c80e9ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c089d78e9ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000002829380e9ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c7e9378e9ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054ea1980e9ccdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce586d78e9ccdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeAuditPrivilege 2776 fxssvc.exe Token: SeRestorePrivilege 4732 TieringEngineService.exe Token: SeManageVolumePrivilege 4732 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3864 AgentService.exe Token: SeBackupPrivilege 2260 vssvc.exe Token: SeRestorePrivilege 2260 vssvc.exe Token: SeAuditPrivilege 2260 vssvc.exe Token: SeBackupPrivilege 2056 wbengine.exe Token: SeRestorePrivilege 2056 wbengine.exe Token: SeSecurityPrivilege 2056 wbengine.exe Token: 33 1404 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1404 SearchIndexer.exe Token: SeDebugPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeDebugPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeDebugPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeDebugPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeDebugPrivilege 4344 2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe Token: SeDebugPrivilege 3656 alg.exe Token: SeDebugPrivilege 3656 alg.exe Token: SeDebugPrivilege 3656 alg.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1404 wrote to memory of 3976 1404 SearchIndexer.exe 111 PID 1404 wrote to memory of 3316 1404 SearchIndexer.exe 112 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3656
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:556
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4824
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4900
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1748
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4316
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2332
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1312
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2188
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1768
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1296
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:5032
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3868
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3352
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4732
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2924
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2056
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3296
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3976
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:3316
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 5e7fd1f5f115f9fd9f2534855a625c9b709b4e72456b72ef1b54e62c68878e4d
- MD5 0b71afcaa87ce35db47ff6aed8a8a227
- SHA1 930ec52718637ddc7474493ca56bf4fe703283ff
- SHA512 4c877085cbb91ba2856f1ba2b8057c1c744d875c34aa3fc72b50043c186a9a1d740ac07937c466be7bae7e6f8337d08b478ec7c437117a7f7151c8ebe2e1d9db
- SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLfJ4klKXn+:93q6HjBwfJ4k
- TLSH T133D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 c2015449a2f7c20b7dd5923de6540fcee6cd3c2df1e3f5ed286a8b341dbd2235
- MD5 246fd3186ef7afc9a4c1a794095f9796
- SHA1 bdf75123552d122ae7b2ab07d0af2b5de5e42cde
- SHA512 7164a6e7aee378d8fec441e306442adc418608f0eebe860fb8a12f4d4cc2ec68f1e298f93559f55e897cddda397426510e74114c32443f2667cc180288ba35f8
- SSDEEP 12288:y1XLsswWkxy2lRq2czAUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:YXYfDtczAUfJ4yL/tNCJPXUQrPQ
- TLSH T1A805F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 c802578d5e024fa01ee36164a39c6c642ab151c39d39d3572edc8a162008689b
- MD5 d77f427f2568f9b642418e9f97d4017e
- SHA1 df0006cb1bc60671811b1538dfe9c4d28736a72f
- SHA512 5aeadf717501381940cb9fb8e5e5d1d3e3603f3d1ef506ac2a9a3dc7baea2e6cba7dd09323d5d2e08a4a513d7d07ce2024bc897a8003bfce835a3169df854aee
- SSDEEP 24576:L0Le5ji0hmxirMzfJ4yL/tNCJPXUQrPX:LPji0AcKfJ4klKXnv
- TLSH T17035AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 1910d0bc92e1f2ba85a4e6aa72a5fcf2d1c174567e54629552d2c3d8b6b7391c
- MD5 7e2334cbb5a1ccc6ba4a2d8aff94ca3c
- SHA1 997024778b38e1a8168633615a62be3d5d7423d0
- SHA512 4afa9b6ff0029a883fef56fe70bd98cb416f09932d91d78bd699b927093b33f615634e2d55ad739c28c08672604c0d9cb75b821fae7007d3d8b3e0c49fa6dd95
- SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyulfJ4yL/tNCJPXUQrPS:y/ezSC6vUzPvxHjyefJ4klKXn6
- TLSH T16D756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 d47f09215877ef9d3ef20be3f08efb02bc516822fc1d5fffc3169905626e476b
- MD5 e4cd7e9b6519c3abc50df453291288d8
- SHA1 fffd6d0f854dc471d6a28a89fc6c1b1d25e1299b
- SHA512 34068f98aaa081b15ce8f1f627659cacf5b8d2c084b27b0904c39915291e0d585a9ef349c3f9f3063f476809093c00375d966d0a0447f213355dc7e9ea23c663
- SSDEEP 24576:0VbqPb88hv/l+6AfJ4yL/tNCJPXUQrPq:0VO88hXl+XfJ4klKXny
- TLSH T14E559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 1ece45562776b5827d6f3a5bcad888b4b7f3c6dfd06e2ef0dcae30722a5c9b91
- MD5 eebeef8290dc38fc14947136fa98b1b9
- SHA1 0ee1d8f580182ccd82fed9777f06bee4b740e28f
- SHA512 b3050d8dbd850dd7ae91bda75761c4af21e82de1f9462acdbb446dfff70311036e665be3762f9e7f120f9d67095011a7c8fa5d43ed3a8c22a9e6b693ac5e50cc
- SSDEEP 12288:VRvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:VRvfJ4yL/tNCJPXUQrPg
- TLSH T170C423E751849486DF6687F82A8CF001C314BEC5162FA2E6DE42B8C67FFC91A559C363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 9f4c1944774695e2791ad32930fd9ab79f85ba191308ce5f78c4a3a0f1728505
- MD5 f845a12d85e8bb751e0abd82dbcd38db
- SHA1 bdac86db07d8e665fc9427f5522db3190197c363
- SHA512 7954eec2b9ebf71302866b83bcbe6cf4c8984d08ee103cdf44f13748ea7a6bc9a23dc00ae9e042d344c2cff47438e6fe629ec61fc72de75a4631b8c17716a525
- SSDEEP 12288:qeBNUbTVO86UIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:qJIUIfJ4yL/tNCJPXUQrPa
- TLSH T12805C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51D79D25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a3bb912279371cf0dfb21a66402c643d8a0dc5b82af618e7a933e074116ba4b2
- MD5 f87d1b76e2a6ca403e291b86b59ecef1
- SHA1 37be18b676bc056d9668f5095a2b8f647f05431a
- SHA512 775baee3e9e7158dd86229fd2b91d00632d7e8a8136b2c4dc8e86a88a39aa4312df88d72bd744e54d586ff1e27c01a5e8495584a46201cff3ddea2245c93cde1
- SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:RQvGAdlCEL8c/yRNw5C1fJ4k
- TLSH T1E1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 0efd8e200ca24ebb83220a1302ffd80e43785bca8a748222ba5f9e954268616d
- MD5 c78e3e7798315a96eba2571ba66d25f8
- SHA1 fef25e984be149933b49f844ce2cafe31e26f447
- SHA512 9dbfedc881f5deb543870748a214811d1826f6acb198411e8dc6df1353dbb8dee43841598872b5ec31fb1145224f7103ab524c51b0ec308e76e01c1403e2d79b
- SSDEEP 12288:aAwSfxL/2Dc34DLLmt0LDQewsAjafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWj:vdewsAjafJ4yL/tNCJPXUQrP5
- TLSH T1D815E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 27d81e914865b38c6ba07dd5d5307971973135b185744aba9c834eadb5f8e54e
- MD5 fb590d8ba5ce2faa710b856f7a4b566e
- SHA1 7a27b99273b7325b87d59537fde4aba1444e8645
- SHA512 82caa91224f12d6f37fc1f7a1c6bd6a6f9c7985189bba2903f154de2e2c315682970acc7fbd1347b0bfe2a2375f6737b91ef7a555f1c4985c22a71623d1a6330
- SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSfJ4:xUEtQevvqc2W1cpV2EI32S
- TLSH T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 9420deddabff2fb4086b775f04a8c49216ac5967bea16c927cedc70489e7c24c
- MD5 8a33523746ca7d7b6c79827ed049e7ae
- SHA1 cca96ac58287495ba9b72e5e4e88ef1c309a6678
- SHA512 b959dcb2d4859d465a54ac356d788919eb2af48ca84ded3315293cc0f4d2508ac82b9489985bae0ff4999602521998b3370a39c2129693d52e2802211ee3a902
- SSDEEP 49152:QCbRquA/m2yL5zifFiV+XenmE3/z6fJ4klKXna:5oqHVjnmJfJ4k
- TLSH T13CD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 8572bebdd4d9f5a55b9051f06c12222f26d6d8834418fbb8713f980c0a1b57b8
- MD5 90eaf15cc78d849fb17ebf98f33a6d43
- SHA1 e7c4f5f5312b64882c31b467941a7fb0d3edc53f
- SHA512 b41dc67def3c8cf436ca39ab3db4d32ab7375efc8ce7bb2cb6f90cd52205dc8c782700cc586b3334ef7e27a609187bf10fae9269691eed047fb8ca1feb4d21aa
- SSDEEP 24576:zAhGLJIFoiwtA5l7S53pfJ4yL/tNCJPXUQrPb:zAMyFoiq5ZfJ4klKXnj
- TLSH T18C359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 be38c682a33f22f8257fa1039ac47f7b73f0bf01fd23f178efa507590a084cd4
- MD5 306bebad0cae2a08386050c8086a2b8d
- SHA1 3ad2e310a0779dc9a65216577972330224f5bd7a
- SHA512 e0393bd7716760f7a555f6c62237a048e338d6fb3d60de3e2a321b8f2ed2d0ebca420e02ed7e65fd7aa89f74fab0f2ca741a886b1db1fc1102ff5023e4470544
- SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTF:zwuoOW+fJ4yL/tNCJPXUQrPB
- TLSH T11505014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 8a305141f67ce644530516a45347a8443cc3434bace570597e24362e872210d9
- MD5 5cb607a43402375d782a86b5d7dc0fbd
- SHA1 b5924be66cd68ae3c4d03fdc9ba0d1ebc6f60c2b
- SHA512 5a0c5729be0c6aa8b9a1284afb7765033885f0be7743c1cb7d6ef8c82463b995f4ce0e61ad24684dbf2aaed0f9490fa4e722be4f7bb0e20e47ec6af8b42deef9
- SSDEEP 12288:gBZ1IyqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:eZubfJ4yL/tNCJPXUQrPq
- TLSH T164E4129B32D460F9DAA782BC89D4D101D3317C92233A43CF5A51959A3FBBAC61D3D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 d6e055f0baa39f883210a26a5da0b68dce49e35e10187179ab522aeb55f6a89a
- MD5 b035b55ceec44e2ba4fbf357d5a2a736
- SHA1 976561f120bdfa432c0dc55045dcccee1ece0d2e
- SHA512 d2d02578cde7808d603e1538d0ca5527fe56a56c6fdf8bb843fa85a4f065072c1e11227ef5c3fd3981cb9a66cdc96ed484edf19f114c07d04154f3e333322fac
- SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:dQRQyi36YOcPQLvw2gAf+PN3cfJ4k
- TLSH T1E5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 f141795d8e23e2632c6f40febfe9ddb6927238f6a789f94f235699d47c90f80c
- MD5 b6371eabf2ca25ca136f7511a6180be4
- SHA1 58f3019c5e00efc62b866d9c865f9378fa4f8b89
- SHA512 d679270aa2442e1af286a00aa68e324f99fe2e26b45f60466c296507635c845bd84c9095badd9ed442c526a7f3b533a0704a7724488c7f47118d53389cc37c03
- SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:lQRQyi36YOcPQLvw2gAf+PN3cfJ4k
- TLSH T1B0667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 5d085373e212371cf148881b24e879e2582cf5d0a52767ac6de2628ea379255f
- MD5 04c81e2a19381e44be0ce7e10b6df80f
- SHA1 ff848d43c5f2840d50af5f77237d5ede221eeec9
- SHA512 f1a44daf6c4f119335effa6119f39abeb4c5b61d86b6520f60f2bdc613c8a1b407b3364478d6606c57eeb25971dc7e3ac27ba53bbb8608c319c43a27391cfd42
- SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LfJ4yL/tNCJPXUc:b68Qg55nhheWu7PNU3/KfJ4klKXnf
- TLSH T174B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 04774b30244a4d86ce89dc969286e0cf35338a8288c3025f13da5714517513fe
- MD5 2364b2656819a9478d8ed4dcf0935a02
- SHA1 0e6211acaa9eac7f52d6f71bb2fe9b084ba004ed
- SHA512 7f83cc8108346d079138e32ceb5ba6c61a4051edbfb86d96d6ea57a53177e719eac0f5b431d042718e6512b055229d0fd7654952e26515144e47105b60a48303
- SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:fy5112gYy5azzVvL69nLKnhZvfJ4k
- TLSH T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 f44f37c2240d333f4149f4a3e51730f3c550d9fd7d7577c673361757e8d50e2f
- MD5 67830989087e3d01b46582184cec39e8
- SHA1 e22381e1382e3433cbadaa57da8a3dbd80f5cd0a
- SHA512 729e7181a6a21ea58454acdfe2c8bc475eda5d786dac87b4a2b64e0a407d96b9fca7ccf05bc5fa96038089fa512bc2c91a82c5065fe2bf0d92172153a7d288be
- SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEfJ4klKXnr:Ju6JmVxd2dEfJ4k
- TLSH T185D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 725202faed15949be67de813c007b0756636a5ace60216abb160d1a249b2eabc
- MD5 0c25bc1df60f5f13794347287384f318
- SHA1 1b18144488c1e97699585f282477cc72ca51cf56
- SHA512 9753b2a808b56d5737ca7fadea3445fd5c20866aba29f54d189b96b907b2597abb23c3788d90bbd5a8b40472718e5189efade74033142dab3e5460a6c49ada44
- SSDEEP 49152:51hpsNoJpF1A6UU44CwH7R4xofJ4klKXnC:5mifPbRJfJ4k
- TLSH T151B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 baf660632e6658ce9fd181651259f0ee41fc1c413b7b6c94502b6385917db4b0
- MD5 f4dabe7501d025e07f58451954483408
- SHA1 02ec29470e65b1727b0900151858df6febf56c6d
- SHA512 2fe4132d70f096d51fe5249bb9b9d630920bf95351cbb67ee36a534ee7c9486139b8de157d5d9b0929ff9766cd2ec5b96ca875f9d765830ac47d22044af5adbc
- SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqbfJ4klKXnk:o5dKTi61bfJ4k
- TLSH T15AC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 85fcebd60f8848e71b2c98898c435574e7aa51704d06a76387acb2d42cccb3e2
- MD5 0c8462eb8dfc6cf337fc54e4fc1ca690
- SHA1 8d2a79c98e84c914cfc9fc49d011145874e17e47
- SHA512 173cca51c3b12cd0004f8a7741b7bc84ef16410b65e88f8810993c7cf791f6ffdb7850bbf3442de412e16fc7d7fe93588219a23b969487328ddfb45d59a0f3f0
- SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wUfJ4klKXnM:AX2iyphtfJ4k
- TLSH T12F95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 a9216688c42a8196f4aeb055512f7e55897a482e9d7a526665fc5de61f59804d
- MD5 814ba9b24973e7688734d98bbb75fcce
- SHA1 e47422058d2ede06c654f959bc3f2a6209852cb4
- SHA512 799f725b374d579ebe2e724d5671d890026e582cbff2734a500fc210adb3307a579fed580bcbb1d0a7e7011b5c29fd149d966766ff5d884db26e362c21d0b01e
- SSDEEP 12288:ZXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:ZXfJ4yL/tNCJPXUQrPN
- TLSH T110C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF42B8427FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 4fc1bca148aa772ff876b524a62e3c38023951c6951cbba538ada7ea079e501a
- MD5 2ecb0366f3008bbff11794d9fd4134d5
- SHA1 94dcc59eb855d49ec137e8a6d68195e7fa864064
- SHA512 5ace021ea1e10fe5efa6bb4e81a0ce24704e57db559dc3b9446607cfe422e60a5e873c07307d86d63420668369b76ad5b3d2fee22d885f6c9689097cff308eb3
- SSDEEP 12288:u2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:u2fJ4yL/tNCJPXUQrPM
- TLSH T14BC423AB60D59486DE1587F81788E001C7047EC6672F62F7EF42B8827FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 31e93ca13fc49a0373e884f89b6cf2807406a8d60ee1e5f4c1f0e79523324446
- MD5 01cb93f489772fe2755e5db0aa65b3c9
- SHA1 a6db308fe0d203f455292dcd8e6f46060fc8fbc7
- SHA512 a13ba7e5d11c62821f823620dfc7bfc65f1bfc23650cee5aca9641e22c8474f80ca6de7db0dea5c144fef40dbf275ac9e9c903771392b5ab668ae2b1346be721
- SSDEEP 12288:/wfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:/wfJ4yL/tNCJPXUQrPZ
- TLSH T1D7C423AB60D5948ADE5587F81688E001C3047EC6672F62F7EF82B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 8c5c1b20cf6529e3d039aa6efee30e6b6579fb4ca7e2869d3b87f06f4a33aed1
- MD5 c8642dad9bb569c17b0bf9f3ecb57f03
- SHA1 176b15d3621098089b887f9139e01557a03ac47a
- SHA512 7bbce8ab3025fb8453d3b96360b70639101e1e8aff6679ebfcc313809f4350d60b5cd2b23f05ac6f6b44e8e56b151513254c306135c89eb806c43c653c4766c2
- SSDEEP 12288:MVJfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:kfJ4yL/tNCJPXUQrPI
- TLSH T1B2D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 98a9185404959222d67215760423966a20e8a2ec050db07b22fe32ec66c2053a
- MD5 572a931256a2d80489a4dfae5431219a
- SHA1 d6ce7d0cc31264839f1042674511a8935800dce5
- SHA512 22aadfaf987729db4b2b08e65a34d389c177ac1503a530d12cb243ef760e736bd62c5fba559597dc1734377a8b63906505789996b4ebaaf2ec33c5837916dd34
- SSDEEP 12288:ahfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:ahfJ4yL/tNCJPXUQrP7
- TLSH T15FC423AB60D5948ADE1587F81688E001C7047EC6772F62F7EF82B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 7d81eac9b503fd60b96f666821f8bfd9c3df6a9f4a62d6bb006c4784cb072803
- MD5 eea70c0a16b167b688f5ea4b9dce86d7
- SHA1 dac16ef9c46ab9eb1ec4410e41f9e6bab7c1ecf2
- SHA512 a578ea5fea0a30a8746457e9443d015e68db2585407dac3e24b9eeb6cd1ea0f8bb93784e40e0c52b6284c25f6eaed78f540b162b331337c8bf1e1468363c8521
- SSDEEP 12288:UifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:UifJ4yL/tNCJPXUQrPC
- TLSH T1CFC423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 688f4780f1d8f4e0421241385177a7fce9f73ed1aae149ac96f6f62ac83bc68b
- MD5 6cbf2e428cf5b8cd4d551cf561aef138
- SHA1 efb770c8fe14c6432af5e1e1e84cd6854117625a
- SHA512 c664d5dcf883ba96e9ef85b58079c455bb62d66c695ca8558457a1ae93d07cb932d99fe438d1b937e5e2e470a28bcadef12c32b25898d69de61f68a64ce81b86
- SSDEEP 12288:sufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:sufJ4yL/tNCJPXUQrPK
- TLSH T1D3C423AB60D59486DE1587F81748F001C7047EC6672F62E7EF42B8827FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 4c0f1fd2de851464bafad5b079b3c6fe44f96cee0134bdc629a3fc60240f4774
- MD5 66f5506b7fa70882f3b51fb4fde2adc8
- SHA1 0960bc1029e1dad0a4c96e0e3ab59adddb35acdd
- SHA512 806b926fc863a0c5a2a3e69bda02eef9eff42542bc5e218710f1dcc159be1b182f74572397895c69fc32bb56161baa3e52b8d7049883d4e80d371a29c2147d91
- SSDEEP 12288:eiZwb6zzFEoS2cPvyWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:BZMSzFVSOWfJ4yL/tNCJPXUQrPo
- TLSH T1E20501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 54fad2a9aedb200b47de072d4beaed00f3c52c22232a85551e0cc75763b99d4e
- MD5 5643d9278c7d5234692b1154ac30013e
- SHA1 05766f7a96b6cd840bf28d4967aa6c5687007b38
- SHA512 6ab1c9f4c9b7635e2eaa5164830fb77ca7ae9d99001c37d5df2a79d5ef58bb8eaed232dbb69b6a65a33e5aef95966cb17c09c17e5e186e715ae4d15bafab3b94
- SSDEEP 12288:TrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:TrfJ4yL/tNCJPXUQrPZ
- TLSH T1FEC423AB60D5948ADE1587F81788E001C7047ECA772F62E7EF42B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 fbddf2c2dc3ed614125fdb89e7af1c063409e473dbb4aad591b39ae0b07ef625
- MD5 578713fb0fc57564e7060311b9b0b11f
- SHA1 5105200b2399e2065583f4f6cb373a11ddf05d05
- SHA512 c25aad7a3fa864ee37c97c3e11ecb446dd81ed71aac02461eae724e6e589e3c18c3098d17e4db156d0e0b1c1cee69c4dd5feebf5189ec74e80395c60b7ac5f02
- SSDEEP 12288:d/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:d/fJ4yL/tNCJPXUQrPj
- TLSH T142C423AB60D5948ADE1587F81788E001C7047EC6772F62E7EF42B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 1beda4e9c9fc80812100800259bede73b130f6823bd206187c1902fa8db2693c
- MD5 755e2f6b3e0a5a522a9bd49b60ab8ef9
- SHA1 b3fffe319f826c793f5c3812112691cf97b33584
- SHA512 9015d197a7b59753ecdd32b9d0aaeee360c50f82d024a98d19a223abeeef048cb76f4496024d9cd040e04bdac84de1d41290173e11fb92cfc4dd175a88bd1fec
- SSDEEP 12288:kyPz5L8qfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:9zyqfJ4yL/tNCJPXUQrPa
- TLSH T17DF4125732A130F9D536827889909602F331BCB2072587EF5B9056B63FBB6915E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 633fc13fccd68dd5cf9d6a477e4a0a179d17651ae9a899f99fea2523cf3f5d3c
- MD5 ff0d477c6ef76b1685f5a710fcc70c80
- SHA1 abd6a6ed4ec90ab4d558dd1433757c6b6426ab3a
- SHA512 5c45488c16a35dbd78f403508db644af8dc0ebf8c8e5fa535f83190bd63d85906eec38a8974b3a681f5e0acd6dbe80ac88dc40b05ac94dd8613fff05de1461a2
- SSDEEP 12288:rrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:rrfJ4yL/tNCJPXUQrPs
- TLSH T17BC423AB60D5948ADE1587F81788E001C7047EC6772F62E7EF42B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 51fc1bcb3147b71ba7c57113e62d19485e2f00f4c8c95188f4007cc332993331
- MD5 4c5f4a60b0c41bab6a38339b71ea09dd
- SHA1 2e073a36edb7c873fba9e23870d4272c9cddfebf
- SHA512 7c59b0ce180fa3ba0455df20c42b8603d2fcd3be9fc44dbbcdfec03ce509e95d728d502d5ebc6b3682a6be9a0d00488886df00e1b0c281d19c40f76e4d8a9180
- SSDEEP 12288:IrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:IrfJ4yL/tNCJPXUQrPg
- TLSH T170C423AB60D5948ADE1587F81748E001C7087ECA772F62E7EF42B8417FFD91A159C3A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 526ad57b4a8fcd68f7848ae61e627cca279148e5c1248de151446ffe23d2acf6
- MD5 219d1fe4955a6174adbeb5d4791f1fc1
- SHA1 6f8ce617219346ff5c7055033d541b9d0e182f05
- SHA512 37ea6ca8413438d4f8043459450599424f12ce18372143daadeffa3c005d8107f067f637409a51fee06c394d3d36f329379cca6c4f55869394a697d14412a574
- SSDEEP 12288:0yPz5L8qfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:tzyqfJ4yL/tNCJPXUQrPq
- TLSH T1F5F4125732A130F9D536827889909602F331BCB2072587EF5B9056B63FBB6915E3E770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 3cbf15d3cb03d7ed4583e3108fe7731e6c376523a02b776d58f27e816e65c4f6
- MD5 f4aa4c09d6d646f0d3e440cb68243da3
- SHA1 178a188822c07047dff42c6396a5555ec2ebb70d
- SHA512 07b9a7fa7e07f9197cbf51b8d6d77c49dd7416051e01a1595984acdb0bf02c9511bab25248f9279d5e4c0589c0fc102dc643d882f4e191e2db64fd51d1ed63d4
- SSDEEP 24576:UcP4mcvIjkGOxhKP2l71SNKbrh/8KBjfJ4yL/tNCJPXUQrP3:vP4m4IpOO67N8K1fJ4klKXnP
- TLSH T10865AE2DA7DC0096D0BB917886658A49FAB1742A2F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 579221ca8c1f91a41e67cc60ad226e69925f5dcd52d882165fdc2dc44206e099
- MD5 e5ba19b866bd2538f678ded7fe263289
- SHA1 c087d1b310f9db4a6af56c65c7ba4845732c27df
- SHA512 9c17c0bfdec0782335f760499081cf9b849265ba2e6b0991d36ab60e0024bcfbbcda1d548c6fe9dc1ea3b7ef6d8bd6822557bfa8900efefcb7fd448361c71e38
- SSDEEP 12288:INsfbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:pbfJ4yL/tNCJPXUQrPy
- TLSH T1E0E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6905DE9753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 edca94cad41ac700119e0ad1ae5a136ae48b10c02f84acb501aeb0cd0a8c199a
- MD5 d5b459cdcfe4d5b3e6b25086b6c6fa70
- SHA1 4bc28ebe8b7fead2fb03f7b4ed40268afc738549
- SHA512 b82b8b1ad633fc066212b22741894fd352538d635d3f35303e803f6f23af857a647c385f9e6f18e8408ed6efe340e93721c4665ee2c62ebad281f8187445edef
- SSDEEP 12288:u7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:u7fJ4yL/tNCJPXUQrPy
- TLSH T1FDD423AB61D8D446DE7687F81648E00093097FD56B2BA2E7EE42B4853FFC9161D6C313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 94471d889be84f75e548d54d82d1a51898e3385ef0b710285f7f271b8885c612
- MD5 f1524e6ed474625d7626badc96ac214c
- SHA1 9caf80d4a669df2ffad9a035b41b2b015b9c5cde
- SHA512 66ec74deffdd78f774d9f33e7ce851f6f763f9ad37173252a8699324874b8676eb5fefd9553295e21c5face162d17e129a957903e2e28805c6fe3135d5a8dd2e
- SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQhfJ4klKXnc:oa0hNYG4JwSfJ4k
- TLSH T182859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 d519fb51f0d4ffea389c7aa03d8f52fcdaa05b18b8b8ce45b25bd348626e23ff
- MD5 8e6a7583c2c5bd514aeb45187071b10f
- SHA1 67bfb199549b6ccfd824e820bef81b81e5e1ccda
- SHA512 19f0aa9c5d189efffb5d24588b2d60b38ec208df0fa6fa4c87dff683ddf6648dde84d7d8828ab843995a07a21b73425f4d8bfc5a38bed11c1e3575077abbee59
- SSDEEP 12288:bhbHjfXmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:bhbHjPmfJ4yL/tNCJPXUQrPV
- TLSH T1F5E402BE22AC20C9E571D2BC5684D106C331BC951726A3EF67C291792F7BEE51C38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 7e9be9475a6c911b4dc9a007500f877893163f592f3861d2cb90d9609d057b07
- MD5 8c426599c5b293e72e0080c532b00592
- SHA1 693222702572bc44c30042502ef3d0c36a99049c
- SHA512 e68fc923f4df79bb9ac82651b66a6a3659c9f138848e24ff8a487ebe7dd8571a1b162252cd6ab31a11ddd0abc4df455b2b3dd7a69489f7569a1cb064b5a06eb1
- SSDEEP 24576:x3YgnJcRTk4yti+R5dpR/+fJ4yL/tNCJPXUQrP7:xIgnaTk46ppR/+fJ4klKXnD
- TLSH T19645B02EF2B910B9D8A6D236450143B5FB71782D1F2196CB0170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 b25bdd35e461a391a90e33c6245c416500cbce2ee829f7316d5c238a8870be09
- MD5 867832e0e043343856bf9c499a146124
- SHA1 0f01b7d8d4cebe43d696020da6992c1ea2b86e3b
- SHA512 45f6cd9fa79fb96bfb0b959c60c8f99c9ae87da2d3dafadae1abf427467f8e617265c54dcc79e676408faeb9e804857d13b000e8558e6012b9bc025e70c361ef
- SSDEEP 12288:MPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:MPfJ4yL/tNCJPXUQrPE
- TLSH T13CC423AB6184948ACE6587F81648E001D3047FC5272F63E7ED82B4867FFD99B15BC392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 b3129e5e026c7133c6410f8ea78392576d67b7587f22d575d7f9da705f9d120a
- MD5 cae488593fa3ed6025f6ce7401be556d
- SHA1 d4e4a57665784a901b7d0d26f81886cb6c336957
- SHA512 5d4d8f4bed0723b9f8822da20246f8ca696251b6c34953635d37e65a5e023c2a0022890910aedb6ce8a2e06a092fae0045320125d112854556508529df69e228
- SSDEEP 12288:7Ob9A4LWOsvAYFTUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:EpL3UTUfJ4yL/tNCJPXUQrPQ
- TLSH T18025F155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 3ac4db9e70dea78330ef4d0651f406a5fde8e116e871c2d21ce84e6a61314132
- MD5 cd5d5559169084270017d49759f62e45
- SHA1 76b913457533f8ae1f0a03b3794c29170cc8812c
- SHA512 f2ef12f9f52a1d8694a99704d3c89079a921b9e9ee1a30ac0c4246b1fdc694bb4ea16fede478e10d9976b1832f67e57ebadf48780d3a1875548a35875c375473
- SSDEEP 12288:upFtpOofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:EOofJ4yL/tNCJPXUQrP5
- TLSH T1C6E4026A32EC10E5D576927C4A85D209D331BCA6172653EF46D080AE2FF7EF82C39761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 94ad9472f687e1e74ffa4401fb8fda923b770069566da791fe11c9be78d3a4e5
- MD5 ba0e85d258bb7f23d4d6c3a376209725
- SHA1 5ff63f205ece13a4735ebcd2993d3a3e1e3c4f96
- SHA512 04d25cf28da293a0b59b2371f68c5612cf394b95c0fbf4a3aca901b5bcd6a60e090cb567bd097dc92cb656a1f35a8b5d603954a63fa98c9f234c57fcd7a0d971
- SSDEEP 24576:F7NM9YmZqmWMUkPjZM48Mv6bEhsrfJ4yL/tNCJPXUQrP4:F7cBWMpPjN8DbEhGfJ4klKXng
- TLSH T1ED65AE2E6BEC81D5D477D13DC9A28206F6B2B4611B318ACB5152833E7F37AE44E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 f1163890ec61a8468d8a0154f5e29a2005ce98a6fa1b19827f7f4ce69631fefa
- MD5 1a76228e60eef71ea5bfdf4af9dd7e23
- SHA1 d787c1659f45b8b13ee5e7a8838ae186655e0d87
- SHA512 17d8bb87578989c9999f1d810b05188a84cbf84c57fa2275ac75e55edd731ac3ef181cb6895ad76aeec779255d0cf0fef64ae020701e46f24029ade7797feff7
- SSDEEP 24576:yW6BApg2YuyuNDYTabvcRvNYf8km1dfJ4yL/tNCJPXUQrPW:yF2YuHNETovcvNYf8kmLfJ4klKXnO
- TLSH T1A7858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 7805724d776290b9a49ccaa63e0cb9d1214be6cb9b62c37ff7bf5146647afdc7
- MD5 09017499e78c52c1cacb1108b0bb34b7
- SHA1 365c753996029afee13b1d43b8ddba5b3d888261
- SHA512 99179e2dfca077f04c3cb7e7a2b686c1d93cfb3fccfd4a36dbb501ee79f422d892dfba9538e3ba112ed1461a8684ebeb21f88d943890089de378efa6037f839c
- SSDEEP 24576:4AFs06+Omlf3NXEbTo8fJ4yL/tNCJPXUQrPE:9Fs060lVXuBfJ4klKXnc
- TLSH T12E65AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 328c0f0d0b246bc158e6977b426edaef5787478b21da26e398c683cb7339947b
- MD5 f4d4253bb46e0821430912a7fa4bb348
- SHA1 5886be0471a1e9f00904e17498a5825eea604154
- SHA512 1626212a4a6bfa2354e1e05bfc0175ba8bb5b17ac92d0c37c9fc175d3330d16a063dccaa48c99fc921e725e586d0c9f62981a2cb4e32652cc13fc4c553d63c68
- SSDEEP 12288:lCJnJ5D3VkrlzxLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:cJnJ5D3WtBfJ4yL/tNCJPXUQrPx
- TLSH T1B415D02DD2A810E8D4B7C3B482496746FF72386D2F266AC768B4D4353F12EE09979F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 08b070d215f75f586a282dda02d1aa54d568350a91ddaa38eebf03b69fb6eec7
- MD5 68321fcfd1d43a38171b845bf6a497da
- SHA1 4a007fa47470a1a8c0ae2f65a13a1bbd6a59ae64
- SHA512 9603a919c182ba56a1fbc430881377cac73b732688ff40f4244aad593a2378fc147196becee30fe6a820087c2e46f8a1a36c01c09a423213381e3dc5fd6027ed
- SSDEEP 24576:bEPohm6/7IIXdwcXrif7qQncjlP65i3Vu+fJ4yL/tNCJPXUQrP4:co06DIKdwc+eQnSt65aVXfJ4klKXnw
- TLSH T180955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 97e9fda04fba90edce4772099fa78b80cd5c018031d09102c4fd1ddb86994740
- MD5 70fb689c5749f0abe54dab207d7735f1
- SHA1 d7b0a9ac84a0e9f55588d10fdc313b3a300da787
- SHA512 33d85b16295944564353a673b653aa39bce83afe96a95118c5431685ff18c69141b814e4fba060d3d7face55fc549a88e1b01a494a7e3f1b6b053990e6f9ab5b
- SSDEEP 12288:CEP3RrFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:BrFfJ4yL/tNCJPXUQrP8
- TLSH T1BDE412AE229CB0D9D526917C4680C101D331F4A12B2723EF5AD1D17E5FBBAEA1D3CB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 e1bc5cf04822f4c48d30eeac08c910559a6713e048b21a0285a76acfc518d468
- MD5 89fc23834ceb31574352a2bd11213755
- SHA1 e1202ce9f2d3b91dc9412929157345bea77ed7ab
- SHA512 754b65f57cb8feb344ba7286a0e1ca545adb51f77c18e1f957c86f64fa3c856487becb2d2a3cef455759a552ecbfefbd33ebfa69febfbf2aa5ea824f5b59f3a1
- SSDEEP 12288:zjky2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:zIy2fJ4yL/tNCJPXUQrPN
- TLSH T172F4224A23D4A085DAB647BC5A55D140CB34BCA02F2693EF9580F53E7FBABD52C38712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 45480e83529e9308c6b4ffe825bb0680eebadb3a5fcec2f3e85c53de624ac4da
- MD5 d4b0cfed933e35535dac1a7dcc2d3499
- SHA1 917dcac08eba1e36a5582bcb72c3c1caff3118a1
- SHA512 82700fdc82ec78cdcaf376f8a3e6c33c88e19843070291ad785d8dee2a5700dbd087491d6602042746a3f627263f85970dd528b948b2d39e47f214d69606c56c
- SSDEEP 12288:mF4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:k4fJ4yL/tNCJPXUQrPt
- TLSH T137D423AF2195A089DE2687FC0648E100C3107ED5272B62FBADC2F4A17FFD99615BC791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 b07453e31c2eada0129e0de3737219dc7113b77af996e74bcf73e103fa3bfcd4
- MD5 060d1a858da3bd9b8cc098d89dcd7bc5
- SHA1 d00fc6102b34f7138bc89f22a5070a4f9e9ead18
- SHA512 0b372a8d291faaf0e47f80781268704e7073c871c17cec1ef27d22b176a822fd42f7f80a79b94b0dd735f31a9743af2ed2426d5171edef3ee7049e9c5f63cd8c
- SSDEEP 24576:vQ9MxZKdcz97w3TfJ4yL/tNCJPXUQrPA:vVKXTfJ4klKXn4
- TLSH T18F558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 7e002a5624c43f53cc555c8dc444378757055ff419c4e0b98ec664917955c9bb
- MD5 5ef65575d31c209cdefd798e748988c8
- SHA1 14ff278bc6dc9d7cec6ad5562cc8007f01d333bf
- SHA512 53541e255f15ee7332baad57b847178f46b97cfd31111acd2c8090e8750331d7679642d67fc566da498729ac9be95fb51929c046aa8d8ab3844e15cfe3f55460
- SSDEEP 12288:ByoKo2HRple9pafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:ByocxApafJ4yL/tNCJPXUQrPa
- TLSH T172F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 4b52c3f5d3b537187c505f544889039dc254ac5707755be3682a8695ae2e1daa
- MD5 3ccd5533d8ceffe0050358792c326061
- SHA1 104c0688ad0583f74a5a556c9ac7ee4042e16a67
- SHA512 b53b22941ea926b1e40bfb9924437fdb50b61ff8cafa96692a97f58bb0868e9a726cb35270a38dac8e35d2d33383274c2a0484b9b04a4584f08b9fce6d2af2fe
- SSDEEP 49152:KWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKafJ4klKXno:M0zuNIOfJ4k
- TLSH T113A57B3DA2F800A8D9AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7be54e845a081da342f1eaf0ae7df74ab9155518607463a9b04870c51c3bb72d
- MD5 a4fba3518e490d2203b200d9830562f8
- SHA1 4f34739c65ebfe222a9abf9940b261e8443add3d
- SHA512 3b2a6b549f51d13a37952bf766c5fac0a0412596fb8f17bb36589b1b1d99130f8e2751951735b92f8e4515cfe0f76150c2f9735397e65dcff69473d7bfd2b51e
- SSDEEP 24576:c1QT7EcpfxR+N5AWAz3ooiYtjMqbFfJ4yL/tNCJPXUQrPY:BTDxR+N5YzTfjMIfJ4klKXnQ
- TLSH T16F55B02EA7F855E9D17E86789A23C502FB727851033193CB42A0C17E1F6B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 a76726d4783377ac3cfb6c6426a0f85057d6e14ce0f4415159e7e1c0882f87bf
- MD5 59839256379d8c3cb87fe590efcf1a7e
- SHA1 294420ab34e83282acdec064c993b0c672da503d
- SHA512 629c7676ff2a4f0650fc76e484fb1b38c1ef79cfd51b912fe7f4fdca194614370e7a44380becf27db582432ebae003b6600eaad2e90132f25857ecfbec62d3e4
- SSDEEP 24576:STMdOz0FFS+imSLJfJ4yL/tNCJPXUQrP1:+0K+imSLJfJ4klKXn9
- TLSH T11615E17E63AD14E5E57BC27C9643D906E67238A6032266DB06D0C0793F9BEE4393DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 8fec954c5b8467d4082337da110c4aa765ae50ea2f004e30d4e3daf8b8355afa
- MD5 423b10b34ba133e00b1049b889e8a227
- SHA1 55f6485d2e2077b595da51c3fc81c5a3bb32b3b1
- SHA512 58aea20c95b9cb8d131dc325ebe6007d2e09fa5ce66aeab4db590068983915ee0dc1ba97eb436cae6182a6bb3f961323ec1f115c95d2ad72b39bbd0c25e90f38
- SSDEEP 12288:i47UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:BUfJ4yL/tNCJPXUQrP2
- TLSH T1E7D4125E23D870D5E87293B84B54D101C330BCA6232A62FF39D1D87A6FBAAD5593C712
- MD5 SHA1 SHA512 SSDEEP TLSH