7cdc28dbe2b055b2619f81842f173a1518d3d06452dbaca564264333724f6cc9

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Size 2.1MB
Sample260415-sdp41sax6p
SHA256 7cdc28dbe2b055b2619f81842f173a1518d3d06452dbaca564264333724f6cc9
MD5 b39e88293dc52892457d834aa524eef2
SHA1 cf0e4585d6170ff1897f93f7a61aa521b0c12677
SHA512 cec97b7ca397b1d87f81eb3ea57e5b87d4b0a9c28e0fcb74f6c4d4ca521545380d61c9e050ed294d7408c05c2432d3fb2eea2fae8bf71e7f5cb837a106e8943e
SSDEEP 49152:yK0eqkSR7Xgo4TiRPnLWvJ6fJ4klKXnp:yK0pR7Xn4TiRCvJ6fJ4k
TLSH
T103A5021278E08431C17375305A7EE3665A6DBC301BF1663F67CC2A3A6E74181BB2963B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4128	alg.exe
1488	DiagnosticsHub.StandardCollector.Service.exe
2040	fxssvc.exe
1880	elevation_service.exe
1884	elevation_service.exe
4520	maintenanceservice.exe
2396	msdtc.exe
1548	OSE.EXE
1116	PerceptionSimulationService.exe
3500	perfhost.exe
4484	locator.exe
3152	SensorDataService.exe
648	snmptrap.exe
2920	spectrum.exe
4908	ssh-agent.exe
1656	TieringEngineService.exe
4780	AgentService.exe
4264	vds.exe
4448	vssvc.exe
4768	wbengine.exe
3444	WmiApSrv.exe
2904	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\625c84bf7932a944.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaws.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e483e6a9e9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1bb8faae9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd9088aae9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc3c15abe9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeeb25abe9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000601d73aae9ccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006e782abe9ccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeAuditPrivilege	2040	fxssvc.exe
Token: SeRestorePrivilege	1656	TieringEngineService.exe
Token: SeManageVolumePrivilege	1656	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4780	AgentService.exe
Token: SeBackupPrivilege	4448	vssvc.exe
Token: SeRestorePrivilege	4448	vssvc.exe
Token: SeAuditPrivilege	4448	vssvc.exe
Token: SeBackupPrivilege	4768	wbengine.exe
Token: SeRestorePrivilege	4768	wbengine.exe
Token: SeSecurityPrivilege	4768	wbengine.exe
Token: 33	2904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2904	SearchIndexer.exe
Token: SeDebugPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	2380	2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4128	alg.exe
Token: SeDebugPrivilege	4128	alg.exe
Token: SeDebugPrivilege	4128	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4292	2904	SearchIndexer.exe	104
PID 2904 wrote to memory of 4904	2904	SearchIndexer.exe	105
PID 2904 wrote to memory of 4144	2904	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b39e88293dc52892457d834aa524eef2_amadey_elex_luca-stealer_magniber_njrat_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2256

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1884

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3152

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:648

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2920

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4236

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2832 2828 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2788 2848 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2957357fb8b09366d449e566d57540bca1700c198b4d67132602b80cdd1b2114
MD5 c68a6fafa56ed34af9bdbbf71e81be94
SHA1 eaecbd37d3c476b72adca0b05852d8e7bcd659ee
SHA512 06c60959a2829693edd114130a510f9bed5d9bd58367a2647bffc6e715b1da24e3fbfdc50f9dc30828f9ad2518183d9709a7e3c7ba23c87acf9c85fc99e5620a
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnlfJ4klKXnJ:m3q6HjBOfJ4k
TLSH
T121D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 dd6499849dfdfbaea09df645476c5906e1536131909de642c372f35b91eabec0
MD5 ad2f126fe79ce8cc0d6b7b7b2376a0da
SHA1 7049cb62b74b11ac198b8ee8f5bcf5ea8e0245b5
SHA512 e39a4b647facbe8a4f3f5e1f965550bcd0224f537b54e0f1512c9f10aa9d6fb3d568a8aebdd3f006ea26e5a390cda5951575ceb426ac07a2c8176c2fc901c814
SSDEEP 12288:i1XLsswWkxy2lRq2czAKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:oXYfDtczAKfJ4yL/tNCJPXUQrPF
TLSH
T12205F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4aa4ff7b3f2ff1ea1c53da8b7043271f474809988bff1f66e6f6bb1ebe5ba795
MD5 beb01a1974173a114cbc6bc33d77bd4b
SHA1 5c469c66d8b526c6595b93b99c25ab800e8a109f
SHA512 06d3819173021ebefb915e22de1b75d37be4659b59701df2d6a640844b0302b4cd7c1f90c84bfb4d56b4343b7c5989982e52532bb85438d9c603ace2c4a488aa
SSDEEP 24576:50Le5ji0hmxirM9fJ4yL/tNCJPXUQrP0:5Pji0Ac0fJ4klKXnc
TLSH
T16E35AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4264efddc6dd6a034c40be092f64cdc589bccf8cb1435b12516b594bd14a179d
MD5 79d8016dff508fe5bd637d8db25d8738
SHA1 8359cc16f514e2faeda52ec0f44d2ef4e868ca5d
SHA512 5a94e5ac801af013455384d714191207faf3b86ef6cee5d3c17a6d1af2961f580ae0b9799a9d4b023cfee0d2bc64785ad9488314f73046a8fc4f031cd989ec2a
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyu7fJ4yL/tNCJPXUQrPg:7/ezSC6vUzPvxHjyQfJ4klKXno
TLSH
T1C9756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 eddff70e7993c35d6f6b0c5b880cc518748f9f465ce09d32fdfd5c1e9d777cb4
MD5 36876904682fd5682231210ceaf095f5
SHA1 2bd57c7a656a226a380974125b5110f8bd940055
SHA512 e6a28f8ea230a35c691adef7490de70dc804b2b68e6b12f54396c4ac38889241e42f032910e24314cc069ec3402570242ef9e8f8ff53c4760078700170e2df87
SSDEEP 24576:3VbqPb88hv/l+6+fJ4yL/tNCJPXUQrP0:3VO88hXl+pfJ4klKXnM
TLSH
T18755AE66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a45d6f1cf504efa3901e2c469acfebdad86f5275e7186300ef993c321705d7f3
MD5 cbac71d61578d9ea56cb32951bd29a5c
SHA1 bf49940f0b9b11d272cd072c0d6326b891beb6d8
SHA512 42d92b0e46887c9abf2c53218f351725f9e3c7be3b0e2bf7dbb788870c60dddd38f52f2680d3d454438b049e9201383c0122b57407e584d3c7c9852a860ee1e3
SSDEEP 12288:3RRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:3RRfJ4yL/tNCJPXUQrP3
TLSH
T1E0C423E751849486DF6687F82A8CF001C304BEC5562FA2E6DE82B8857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 6f351d228a13d0d31a6933ea1ef6a8b664309b54b30b7c3daddda38a70971d82
MD5 20ca10e8bbac97b1c74faa703d21f88b
SHA1 bb679b6ebcb9fbf97be2aa4eb0f4c49ca07b5eae
SHA512 a0b0a9301e2ac03dd60ba87a365a58f5104dfaf4da205ac078efd08122066c3a7daaf0c813a70a2909f3fa97c845edfaddc3dba3231c840e861b575119bcf59a
SSDEEP 12288:ueBNUbTVO86UWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:uJIUWfJ4yL/tNCJPXUQrPz
TLSH
T11505C07BAE28FCD2C67A8DB85790C200D77278704B22A3CBD165C20EDE275E51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4377a2d4f2a263a0371ab7e079e2915c5d0becf4d6d23c03ef4a7d1b8eb6f24c
MD5 149e339f95d34db24d61005a56de3571
SHA1 57d2ddf243a19bf3cd03d7049504ab88811e4d96
SHA512 5157dc96afc64fabc2eb7849df22099d7dce67c3f877e2c9434bfb336e90c80c3acb50c022797356e557178a408cd27d984b3de80476b219f1c068c6cd567dca
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:DQvGAdlCEL8c/yRNw5CrfJ4k
TLSH
T1CE266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2d6d2d1ebddea332692136a0fd7dc8298391d4a6a09957e632ef1bb6dba8a9d0
MD5 5a6481f60ae50ca15acd4d3047234d16
SHA1 f7d68b2dd0a1e5ef45b734821e83806513ad9998
SHA512 c4e378e2ea457bffda168181cfbfea0bf93fbaf3595ebd55115fe0a80777f6e426940878a83c1132d4a526eb242bac13994ca027bc62e4ffb88265ab59d96b05
SSDEEP 12288:/AwSfxL/2Dc34DLLmt0LDQewsAjkfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWo:IdewsAjkfJ4yL/tNCJPXUQrPS
TLSH
T16E15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92b313ca62a16ea3292d0642f0c8d2a55a2d837e4fd8693fdbb365807fad8f9b
MD5 db9f72e90c676e663c4d2810197d607e
SHA1 60a698b9022cd8a66735bf8aba27f2f1d76db71c
SHA512 adf18e141ab228356b28966e4f520693dcf8bf92f400c979a743e4e378dda8c7ceb3a648d3679c2c9a42efddca3a3bd2234c31cdddeda1e13de3560d8d42f00a
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHMfJ4:FUEtQevvqc2W1cpV2EI32M
TLSH
T1AE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 dcd74da2f84342f38971fff2fb3a02c029d40845980a53f98cfe14a1cff5ca9c
MD5 6914e16e06fff3ed34d21601625123ac
SHA1 9fc5f16f26fe313fa35f7d957a37ed9d9d73209c
SHA512 d4b6dd64d9a9af5b0db1a738550588c34283ed84e24ddb7eb3737630766b8b694a6e1fb9e8f0fc9336d3257f9e6c2ba30154c37950e9c3107f7c50daac8da627
SSDEEP 49152:GCbRquA/m2yL5zifFiV+XenmE3/zEfJ4klKXnq:roqHVjnmXfJ4k
TLSH
T139D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 77903c2da6f50864c21e6847b5cedda07ed30bd643826bd9bb9a7dcb5a076077
MD5 4c27944aa674eae8343946b9f50564f3
SHA1 9a4bfd13ab018fac33a906ac60c86f18e139ed98
SHA512 63536e68ca47a5d815e81dd6abebff13b77334ef5715bbe3819269e4cdb33aceb5f74ced33fae77e5f99af45ef69316523f3e5849e39b67851c7c8e3565d5cef
SSDEEP 24576:cAhGLJIFoiwtA5l7S533fJ4yL/tNCJPXUQrP6:cAMyFoiq5HfJ4klKXnS
TLSH
T1A9359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 c0cd577a47a318756511051f4b3e69dda21ddbe82f40687671485952a07dc69d
MD5 d1625de7f168a6c53f83cae97334cce5
SHA1 0dabe98c96523cd1f7111e121068f3f256f73f76
SHA512 e188e49578c83c5513f3b2e5d1ca7b38b266ff06f309d5abf091b1cf6f163dd5c25ffd0cde92b4a85e3c0d804434c95a5a23049b0b00678c65f1c81c2c191849
SSDEEP 12288:Pmw5HEjsChNVBFgl0WDm+CbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT8:uwuoOWwfJ4yL/tNCJPXUQrPo
TLSH
T15405014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3105b83578195ede0eb1fdf7a2fff653c84f82ba9178316dcb1427c0d5172ad9
MD5 875b96425e6d67add24791a891fa5ff8
SHA1 f3ab2bed90d82265f25d0952a45ed707d8cd33ff
SHA512 801f10b730327b9649d5f4e6955fda48f18aae48766df0f078d738677ac119e3fe2cbcb43fc825b6a053ab76693a9d45af22c7766da42e3da55efcc3ee493d89
SSDEEP 12288:MBZ1IyUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:aZuVfJ4yL/tNCJPXUQrPr
TLSH
T109E4129B32D460F9DAA782BC8AD4D101D3317C92273A53CF5A5195963FBBAC61D3C322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d3fffdc31705511da5b70673ce5eefb44c417497f492a83180568e299431baa5
MD5 bf56bf94ffe34a4157e5aae8da72f95d
SHA1 c6f36ab5b551ecfe02a848434377008ca70ca9bc
SHA512 2a0d7adcd303a6f179930607a0b1349e1911cadaf5c625cc4483fdd17b9c6e0aae01781f607733700e678d184f1363239344121ca25b92c5786a1bfa7e9269e9
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:pQRQyi36YOcPQLvw2gAf+PN3CfJ4k
TLSH
T1A7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f3e18e3d220893208f26039738377b59b14bef77a73dea2a72b434cab59f4557
MD5 0a948b9a6d10fc640667c9e05084029d
SHA1 974ffe37924d3b9bfc2c5690d5b50e6bf6c67c49
SHA512 d515bc810738636cec3195ee3b07bf9a678d0961b2b352bc903f003a13ef6b5f732b219ecd9de6e8dd1a074dbd5df4d51b3ab4d94812418f8a39f222ed49a3d2
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:iQRQyi36YOcPQLvw2gAf+PN3CfJ4k
TLSH
T1A8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 60f73a6749a26bc3c6855a3788783e1c158d8a7d716959e4a070b1dc9099bedc
MD5 6b255c2b299d343ae8e569069684eb3c
SHA1 4cfd3b2160fbc786b71b9fad350fff2be069099d
SHA512 909ae36f44a5d4e96590202430192444dadcf0c70adcd4df477ebd867cbda70acce569d4e61cf8dde3ad54d344f0dc28e7aa39c6d0d98725ae12d13c11276b96
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0lfJ4yL/tNCJPXUI:P68Qg55nhheWu7PNU3/0fJ4klKXnf
TLSH
T1E3B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4fde4fb7661fcc0c76db0ef8a9b3ce02d430385885bb8061df5596cf6b73be2f
MD5 be595b18674149ef9755f2a68a0d5f1c
SHA1 ed7fd49da5be4cb4a82a1e317d25cf904561a460
SHA512 d71d2cf2a3d8c6641f2ccc3b0c0efda650d92f65455b197e8589d8e5e324932501fb61d985ad45742572f0a628ead9f4ed025a0d81623912f19f13ddef3f3e0c
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Y:Qy5112gYy5azzVvL69nLKnhZRfJ4k
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 db80be0501b5bf75a6c8e1933749aa07b53b7237731610581a67344067066487
MD5 9d8998eb2f9be4aa823da6dc1a2270fc
SHA1 16146cb0238217e45cbf0e6f6613b0be6b988836
SHA512 12c04821d8a757825382dafe6d0341aa8eb1efbaf9d9982f6a11efd1a1f35660544c3e52a9ff6b7b29da2c0ad77d006e951eb9cc8800f6c22c3aea4e2f93280d
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glafJ4klKXnU:Uu6JmVxd2dafJ4k
TLSH
T174D59D13F1D901E8D06ED078974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 192938da1a2f5189d265d0c4467a0b217f1496e7c5cb4fb4faf8ec3566d44a2b
MD5 c7df797848713ebc0c938c24b2454c45
SHA1 6192261623d1ace6da0b5e527def8fb1c265d4e2
SHA512 9906b5c0f764606aed3553a4000c750ad36aae26e24886fe2f53a1dc356bd666a875eb50aa268bb6dfdcbbbeb112929c764cc3d881f1f14270a745924f946e5b
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4x2fJ4klKXn3:/mifPbRXfJ4k
TLSH
T1A4B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d82636b7513efa6c2b5e09107044f78963b8c0b96cb0ec78efa418b66032bf4
MD5 1e3dd7aab500dd4b8f27deb4b4accb56
SHA1 231db11141750fc6a5fc26368144b2d66bb0b99e
SHA512 1209144c2d5362cf1272ddc9e0e1b01a8715fd737d485519ebcb9766d5e6e7562da36acf8e42730ccd6035ac30a09d01e1cd2236086eaf04852c6d69d747da62
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqVfJ4klKXnh:u5dKTi61VfJ4k
TLSH
T19EC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 096dbcdd69d79b43e71d5efc3453aedaceded56a985a6eedec1e7ec2378a1ed1
MD5 fc98272651574c4a44864c2abb4e7f54
SHA1 f43eb41ffa36d9e40a5b3aa089b452d425b62535
SHA512 e27b8ccf097ae7a509653517dc72d8b99a1ac004aedd77e9bf183825eab3973fd5397b4b8986292da9c01f6c56225d36cba40e4fb043ae6220c0eaa02e592740
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wKfJ4klKXny:RX2iyphTfJ4k
TLSH
T1A695BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 7ee755e5aa38efe09425bce2b793a772870a084995e8269075333123b6e79dde
MD5 6a101cf24da205daa6f95255670ac995
SHA1 5a1de6c401819521094db82cfd6fa8bcdec7209b
SHA512 ef06abd4bf990f50fae777fd1f935a1bade94ef88315391135bb8643f35bf3934244b6f57f7864e826c5df2910f5c6d0c6dc29b153365178e68a35cd994d56ba
SSDEEP 12288:UpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:UpfJ4yL/tNCJPXUQrPE
TLSH
T123C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f5c454dc0265cb342a9b81205a77de00736a50378b0dbdabc7fd7b2f593d146e
MD5 b386911f994e0bd5aa1a43bd1f63521e
SHA1 8788f4dd29d725785d12bd187dc5a8f8af191de2
SHA512 eeffd05c9cf09731347177b03ce519aac145521a8e531acf5a1d38186729a79eedd7c5de51d44f2ae585e59608b26f7deaaaf06e5789ea6a0ede086dccd04e40
SSDEEP 12288:AYfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:AYfJ4yL/tNCJPXUQrPF
TLSH
T112C423AB60D59486DE1587F81688F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 310b0202dfcedd9b91e3f7a68288ebf541ce2ad5256544984b9c5c05894805bf
MD5 cefc8de33de133dddf828734e6e9a90d
SHA1 438fc2cffff3fabbc69e978942cda05d1a45ebe5
SHA512 48456d3fdf6d2f7726eff789af5971e70633745d941356a4605118f5792fe7e13ded6eca2945d03afbd1d6dc99acc3b3141a17eac3c4f1fc53e9cef7e833d187
SSDEEP 12288:7OfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:7OfJ4yL/tNCJPXUQrPF
TLSH
T158C423AB2095948ADE5587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 94a8c4537ca04a2df1780c7c0a45f7f68c9f19ef05aada5eead1450e00a88a9b
MD5 8215cceab35df6fac5c0b88fc386db66
SHA1 3b8e390bc4a0b39da872bf02491701a56d2bc4d4
SHA512 a327cb63fc1eb96f7109ca65cb71a9f788b61b812c991168817bd914039ba1c4013049e7d438037eb44c407d93eaf80511a572f2c7a5079be90d10c349621737
SSDEEP 12288:UVXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:ifJ4yL/tNCJPXUQrPC
TLSH
T1B2D42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 da8a8a46399ac6cdb139d6ca474a21c7393c9ac2823d28e60c1e3426aa233c1f
MD5 c01e7a61dbe09a149b50fc20e1b70d67
SHA1 8b78ce369fd8c2861df877af32f8e59f07c86fff
SHA512 8cb5e9bc2b5c27c3097c413ab8f97552fae45d50181a8be3281525878ccc56a045cfeac6efa3ac905e51384a0303029c11bba5863ecfe86632789202ca72b1bc
SSDEEP 12288:8/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:8/fJ4yL/tNCJPXUQrPS
TLSH
T19CC423AB60D5948ADE1587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ae016cf241bffb7beb179f7910b6b451509e2823c0dd04daec7211651110549a
MD5 16f03cc1d62e2680873d60dc49a9948f
SHA1 c2259aec6f2e005ee5f487c6153a53fbf8cdccfd
SHA512 2086896c449f783a4f8b6233d8907bbd33c7bad7643f929fc4549baa08055be9ddb9a1d1afcbdd17ecd44f9ce7af61af99042a783f123d12c15e9c9e386bfb43
SSDEEP 12288:+8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:+8fJ4yL/tNCJPXUQrPS
TLSH
T192C423AB60D5948ADE1587F81688F001C7047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 c0b9d12be01f79655023e5820a1fc15ecdadc088775d2052a1a3c04f650c5f91
MD5 9a4ec6ed4bc4cabe978fe996ff5722c1
SHA1 e119e934c719e57bf41502b8dd94a1ecf59ff667
SHA512 575598649807a6b4441d55f3491554d364444e0b8d7b4e794eabea947a77dc1737e7734a3483bc36971e8f3261faa5142169fbc81ed2aa8a6c084dc462af5314
SSDEEP 12288:WAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:WAfJ4yL/tNCJPXUQrPI
TLSH
T149C423AB6095948ADE1587F81788F000C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a120da5ed97cc975a14d71c3a550044a5a2281e80bb42efebebc198b1f7f775e
MD5 37331e64b24e0cbdf82bb7fbc22cc227
SHA1 07aece40473f1ceb85429053f981eabd0c633286
SHA512 d3b7ea1c6d5a82482fe46a73c161c2bf5a8289f0b5889c8210427e279ac8c57ceb33fc0551f3f49530ae65c70db1cc75cd7f0fff9a8f06120a6ad323ffa327d1
SSDEEP 12288:8iZwb6zzFEoS2cPvy4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:fZMSzFVSO4fJ4yL/tNCJPXUQrPq
TLSH
T1C80501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 16ffe544bb6bed98c5c13ba26d66c27743ae36fb63e6cc1bef410cfb3cbf0377
MD5 3f01493cdf85693aa930d174d9e06462
SHA1 6239a8e4b046ecf84625c3aaaa54c722ec3c0768
SHA512 35c365cb55a4d86c890277ca0952e772dbf81071d1964082689cf671efa0cf9d15d61e2dbccb127e5a644cffd1244f76a81c08e91d7603b7e656ded10d8075a5
SSDEEP 12288:cFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:cFfJ4yL/tNCJPXUQrPh
TLSH
T19BC423AB6095948ADE1587F81788E001C7087ECA672F62E7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 f6f11d7ac5e968d06dee7786a336e79128e14ae4ae15329d165c62b9724b787a
MD5 67f1e04a2b489f71d0f651e202c4af17
SHA1 4843ce3fb716e3cee97a23e6b95a2221c470ae78
SHA512 a27a29b41c15ebb7be5fe76d1a847fbd6341ae5404f3fd9a822fa049b53a0bfdadebf6ae62989a7655fea1df3356f679d0b7e059776da73f500f3416cb48f92d
SSDEEP 12288:9BfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:9BfJ4yL/tNCJPXUQrPS
TLSH
T100C423AB6095948ADE1587F81788E001C7087EC6672F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 411aac435bd943971790cdf48ba68efb2b78f095994b39b0a992d732072cccaa
MD5 13eb09a5d0bb9a362d645d260f830d9a
SHA1 bfce3946daf6e931e00a10a6fc2f2644408ed30b
SHA512 d82a94497ff93542396282281f0ea2f0bafd5fff86468d0435cc5e9255d0fcb38a72732c6d9f3a14397e674e92c3202c8ef420546eb0a7df0717f5f69b987233
SSDEEP 12288:kyPz5L8UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S7:9zyUfJ4yL/tNCJPXUQrPY
TLSH
T16AF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 acff15a8614cc6be10c80d6b5f4289bb547282ce04315c43e4207c971048d329
MD5 75142c809b5604dbd84033c661df7d2d
SHA1 83907afce51d5e5850940a4516867bf16b7a08a8
SHA512 0617814877cf63d034fed1b2557191c1d3a8eb670dde046e9e37fb7f81fdc34d4e0e81a6a73d3d8cb8e8fa8368fa88edd4e869472412acba00c06508859bb2a6
SSDEEP 12288:MFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:MFfJ4yL/tNCJPXUQrPM
TLSH
T193C423AB6095948ADE1587F81788E001C7087EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 16a712c7869ea188ffe84d925b2a626100f51f4a3e818838846a55b4f34671ad
MD5 0e00f2e8e22684fab83617da5458662e
SHA1 3677e18ebac9b9beecc7c66c8bd4902dc7016c56
SHA512 cf6131f0b203d239df65c37e0904f714f133fcd56e707e4faa5b44f54051ca6b200af8b4611e3269023d4bb79f180455a8c54067c594c59bf4ad7b0aa10a77e0
SSDEEP 12288:HFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:HFfJ4yL/tNCJPXUQrPz
TLSH
T158C423EB6095948ADE1587F81788E001C7087EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 55aa407bcf388fb77870686e06a7c22211544b28ccb8aca7a29293b2ec8f5e49
MD5 d302654f5791cf41d8d8eb7d462acb94
SHA1 9b25c3e7f170ca39feb1ea4301057582d483e9b9
SHA512 2e410979d869b585bf0bc979d9bf5a6877b33462fbb8fba030a76df30ae1a7826c097902a81f41046f406951127cc58217084a8d2e3c18134934638d89a2af62
SSDEEP 24576:OCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvASfJ4yL/tNCJPXUQrPF:OCUxPTY+8Wg2lIL8lrIUJLWw/fJ4klKN
TLSH
T1F365AE1EA3DC0896D4BB81748A51CA06EB32782E1B22D6CF1160C37D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 553d614539c354b689085ff00c3824908d4801cb5dec7b96a390741fced8372e
MD5 d74254c312e01d021a1347c26076961c
SHA1 e0d73598d7a42cfb5aca61bc2fbd46f8a7c4bbe0
SHA512 bff20e4b0f99bda0562abe84768dd816968567698cbb4eb3bb8c9f3fe36f071781494ce12bf01a201bda38feb9abc4d1a94796371542c1e17f5778ca9ef3b1bb
SSDEEP 12288:ENsfVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:VVfJ4yL/tNCJPXUQrPl
TLSH
T1C2E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f9e352bff95db0f196ce796dbce6b449b6aaa1f141c5016826f15d4305b9a59f
MD5 291d118eff21dd81f92ebc2cee727361
SHA1 aefb1056b77966c178440521d17e41e63eb3c380
SHA512 06950dd9b75e363024bbee14658e1669e26117c508918df06e82a3ac42a00d6cf05d2607ea0327fa914ea219710562242cae17647bbd3da83482ab25c38fe547
SSDEEP 12288:wufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:wufJ4yL/tNCJPXUQrP6
TLSH
T108D423A751889446DD7A87F8164CE000C308BEC56B2BA2E7EE42B4857FFC9961DBC353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 85478189a4858a4c9ca7affa255cc8be3ec2316b3770a31bb2375c379f2430a0
MD5 085d8c556af0b20a79ac31f06fbe956e
SHA1 1e3e0d32bb4f272ce2c6065605b685643980215e
SHA512 8227768555cceab2fb6a0463916eccd11d26ffec07e28d1570c6192dd4c6b9c918899b63dc3c2edefc0d61b7f914aa7c2a3173af4b0e809b2dc761f30da84e8c
SSDEEP 24576:38RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCEfJ4yL/tNCJPXUQrPO:sRZwQCyiHiQEaiPnMdfJ4klKXnG
TLSH
T15D85B01E62DC46A5E0BAD2B8CDA74407E6B27816573193CF0191C27D2F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 deb835a5215d672f847c12d7852e0cdafb70d3ba4b2a0b0e68cc5f3657287331
MD5 0b3c72dcb096df91bf2acaaceed8cfcb
SHA1 b8b7daad7de66df78137075adfece251e105dfab
SHA512 564d5c4c90b4a97969d6ecd87c29a11f358eca706482ba7caf1cc5e8569a76b8b3c382496f460d7ca999deb281e3107048fd493b96daa7d36358b4a07eaaa825
SSDEEP 12288:sbxA1U7KefJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S6:sbxA1UGefJ4yL/tNCJPXUQrPJ
TLSH
T1ABE4126F229C24E5E576927C4984C001C331BC962726A3EF65C1D17A2F7BEE91C39B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a80ace9b23450078d213f05ddfbee95dc1e837f3b838ff6d5aa16dd57691d20d
MD5 999a300f21f4a9b76e45696851f49dd9
SHA1 f14b7754be6d68c19ef6627d9bf231b060b69cf2
SHA512 8ba216e2b5969d9d7f8d4d71a53e5d463014ea157f6cf01f1b5fee49be4579d1eb0055ab90912e6413de34d01932a49ab82a4abd8009d30f0f623a00c5593f9f
SSDEEP 24576:6jsmP0yHaqrVqHra44KDzMsrnHfJ4yL/tNCJPXUQrPJ:6jRP0yHfVqzlAsrnHfJ4klKXnh
TLSH
T19A45BF2EF2B910F9D8AAC176454143B5EB71782D1F219AC70170C634AF0AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 913912c6ecadd14a4510963a750f6df80a343ed8bf9062b1c16d9da5128b4814
MD5 896cf41936b4b6d84ba608a138b60936
SHA1 a9a862a178fbe0be09aa0efdc9fb5af52d948657
SHA512 f72979141a42b5255dc9120ba33d9ceb4eab99588ee4efbd0cc1455022216e4d33bab372ef7eb76beb411ec3ca90de1c57f06991d35d719dffea164c87d8a21f
SSDEEP 12288:rcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:rcfJ4yL/tNCJPXUQrP0
TLSH
T16FD423EB60859486DE6687F81648E001D3047EC5272F63F7AD82B4827FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 17e3cccd699ef1e6c1e6b89dda327389150c0e38d5c8de87d65709e2e6e0149b
MD5 555e2008c965e6e87ee48edcad536eee
SHA1 c438b9187252b4ea0c767067ac59b4895262b1d4
SHA512 f91a86dc8cbf00145a010110ec70bfb3cfdb9dc53878ad651474980bdf6978662de56c67454f9696086fa3d72d30f3d5cba01fb014dcbee403636913af34dab7
SSDEEP 12288:/Ob9A4LWO+vAYFTKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:ApLBUTKfJ4yL/tNCJPXUQrPJ
TLSH
T18A250155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 cd0275e12093f247a72ae5676b0fdaa44364034b039aeede4c878bbbe74df370
MD5 981e4a3973e3fe64b0369d66322b0762
SHA1 486bcbaf58e482ffb34b75379913862cba52d141
SHA512 39aef339465e2b4096c90253276d1255d8e01002c8e34403984ed290632c53607c8d807c346ba846016657ac5b02edb0a59001c855d60122264bda4f36e617a3
SSDEEP 12288:A70VmvIYNvUyBp5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:drYNHDfJ4yL/tNCJPXUQrP5
TLSH
T19105F12F62AC08E5D93B927D8AC2C105F3727896171692DF05A0C2BA1F67EE97C3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd8e47dc94e8b28b2e18a4c318dbefe0b2722b5e650e293e107f5b65ac2b7369
MD5 d425f7ca31c3d2c17976a70f802e8abf
SHA1 36a8d0e8e3b32bb968ba88e725916b0e87ced8a8
SHA512 7880392711036b886001eb7e135c88af4802fecedeec9b0e316d4e59798eff0f4756ccaa3125409f5c2b08dfb6b53f0366decff27a5578e1855089c22140d623
SSDEEP 24576:AnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKq:AnXoJJYH84VVS6AmEcJas+cHBjSSKHPa
TLSH
T17665BFAEA2BC04D8D5BBD17CC5C29506F5B178621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 add19e57d53524f151375455b5bbb935c702b5777ee1da2aba8385e76fba274a
MD5 f26c325b72a009bb41d84aed9d870b00
SHA1 43167fc34cbe4ea9c556789e57c4409e1981e767
SHA512 65bd54d96878e024997532f2bf1b4872d90d2e99ae05140ae9c24e93766b4fe6bc33ee6c93c076b7467694446855a4dc4977e11fd373e7d79f6abda233a53a69
SSDEEP 24576:Bv7Xbxd9Tuycf8M/TYlSuxrr2PCxfJ4yL/tNCJPXUQrPw:BDLL9TuJ0M/TYj2P8fJ4klKXn4
TLSH
T16E858D5EA2EC42D8E47BD6BD85B69047FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 11093aede10343e3c3507ce73ba1424c727327712d18e7d76cfa2b352b81ece3
MD5 ee3758453d38764cd6e80258d0ac543c
SHA1 6f2f3c9bbb7eb1e043041cf42b8000e1fde066ed
SHA512 4164318da6ca9bc73976405f3b1b92c0aa6c16a6e16b0dbb96b2ebcd1db6756835f2c8dec7a320f00e1d24cb21c8a954e10231a1473c7069b825bb368284ed63
SSDEEP 24576:0egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wKfJ4yL/tNCJPXUQrPl:0ngOJOmPOHhKfJ4klKXnN
TLSH
T13F55CF3FA7BC15D5E03EC17D8A968806F6B1786603265ACF0560827E5F1BEE42E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 04eb67a8fe156d681c9ad9cec4d22d2beb0d5568bb69627efad2f6be9ba1ccf6
MD5 31734f25bf5b6af5d7a0714020919dc8
SHA1 bea232544c47907c844b398dfa150cfcae0c431d
SHA512 3435d95834fa85c124db245a41499ca30fa6d3ff0a5841df14ec865cf400a90d549ec63b420f817f34cb2d8583abbe3be97f11e3a2c2e9ad801a871111808038
SSDEEP 24576:CLJnJiTk3R3waE4JrO8fJ4yL/tNCJPXUQrPY:CLJnJK8R304lXfJ4klKXnw
TLSH
T1A315E03DD2E810E8D4B7C2B482596656FF31386C2B2669CB59B4D4313F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 45d8c9ad87a77b67c96fb9d2b07b624aa9fb7bbf491fa70529501b279e33b472
MD5 53a111ac2ff90787e5aa91814cdff999
SHA1 12d60736297ee26ef8fb311e001fc6ab49008d02
SHA512 e39f03ca27c945363a26e040c5394826643738dbcdb52304858b35108265695bad6786478305c64a0719a092e7e668625809d6813f648bda695b7c5f9c5097e3
SSDEEP 49152:E9mqCzDScAZmlvTcFg8Ph6AfJ4klKXn0:WjfJ4k
TLSH
T143955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 9cbd04f9d2f82d3254f5724384ea4c5d32bb70030a2dd81528e7d9cb00021519
MD5 9815b9f6cfa37436626072e79cc9632f
SHA1 18ab37b464d0d47e827d3c2287ddc332623600a8
SHA512 b0d2e826e7cf74454e1d21db81ed3a9f244cc2cb6f7ad510bd8b17cc7fb303ddfd091d244d6c0f24b31e6ea46c45825cc81817fb73c8cf27ed53c751cf93439e
SSDEEP 12288:tlYJeXm5nkEUuE6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:tlYJeXm5jUuE6fJ4yL/tNCJPXUQrPP
TLSH
T1F4E4129E319C70E5D52A82BC5594C100D331F8E5231663FF96D0D0BA5FABAE62E3CB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 ae302dab1216c567d4a8dff2782df7b056a7fb8f3664d59a6d0afb56b8adf42d
MD5 8ebf8bef00ddbdb7d01eec18f8ef5f49
SHA1 7edc58aa33cbfc0497ed6e3d8a3b44c496897b59
SHA512 6f78c6b7c85000a0cc2c760459b16f1752c21b72bfbd75f6848f4af06b3fe24294bb67d00d5bff041b7ec7187efacc462374177aed82e4a7df142cafdcd5cfdd
SSDEEP 12288:qmu6kynfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:q7tynfJ4yL/tNCJPXUQrPT
TLSH
T125F4125622D4A098EE7647B89A91C040CB34BC905F2693EF99C1F53F3FBABD56834712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 69645487534549e7e83f36bbcc5e0d68c31e39f26bf249fa5e5f8568ea8c6fe7
MD5 0b4e8b624f222092dae34ccb11fd4cbc
SHA1 b401097f8578f2172ee8dc5371f436baf66d3312
SHA512 c8c0c893ba79dce237becef09b7b47aff14cee10f15a3e890aadfead76d13fc7ba4e9f880ac83230fe1c2e6cf88e450dc6a3ded1d7508ea9618af7046401cc83
SSDEEP 12288:2PKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:yKfJ4yL/tNCJPXUQrPn
TLSH
T133D423AF2194A089DD2687F81648E000C3147ED5272B62FBADC2F4B1BFFD95615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 334cb9900ce74d431b1fe3272bf86e548422fefd5442c4188d6df1ce1578b9e0
MD5 37bd573e93a71fe59b7650230bb06171
SHA1 bfe3b6dc82100891cf198fd26aeb9a243164dea4
SHA512 5edafe7f75cd75f573c22de7ea5c70177efc704796fcbef8318bec00f4a08ef5d5cd91c43fbcd26cc5d9ae652ddfb617efe5b402497930469183dcf0a3e17997
SSDEEP 24576:VC+TyQIu93VAumZr7jm1fJ4yL/tNCJPXUQrPB:V/TfIq+Y1fJ4klKXn5
TLSH
T1D8558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 059e65649ded869267057891b34e450550ed507644ead73144a764b39522c9df
MD5 c233c1200b518871dfb71b43b9356518
SHA1 26e59bc8fb98f236a9905e0dc2490d6895da24a9
SHA512 61f78ec2adf7d1fb06aef6a1d13dd49287f9bf14013b06670b414777243fa305a20ecfdd16dee22acd16d5e967cb46902e55ff542644a8db41062aa87cdde5c0
SSDEEP 12288:icyrWOstaa3kcsmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:TLQikZmfJ4yL/tNCJPXUQrPb
TLSH
T192F4F10FB3AA00A5D5A7C27C88848102F77378B5571263EF4690C7791FAB5EA7D38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6e745324208316371e7ffc77406b2e9e692940d6ce0d19534e9db303c5b23af4
MD5 8a0ece4f436aedcb0bb07f8db29c9fb3
SHA1 876270e5547a74aea62363babbfbb4b33c2bc29c
SHA512 3dc3f9b2756330682bfae61b26b38d2e35e202603065ad0d750bb1b7b7820bb2a66678b15c84ed3f95dcdc68ec60da9a900bccca890d8cdb3c013f4229844662
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPnfJ4klKXnt:DpC7b4+80GTkIfJ4k
TLSH
T1D4A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6fa5676202f205de9a86cdc612da4fd50af20dac880b50e1c45ee10b36ca3a1b
MD5 a3cbd29a7972cc4bf5b573248bafcea0
SHA1 2bcd71d111ead5a061816ec12a151d3975573e05
SHA512 435065c686d110d57b16dd5768cf4441f7e3fadf5ef23157071478f1563518b98256b63999d57709e8b3ed6612beedc4978571b19f6a007ef6c4e55c77bbdbc4
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l44135UQffJ4yL/tNCJPXUQrPd:fqPCIo4Kol4/QffJ4klKXnF
TLSH
T18E55BF2AA7F956E4E17ACBB49663C101FB727823133163CF9290813E1F169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 a9144c5acfc2b575400bef2b9bd039b4bccd41fbebf8f864eee56003cb5a40c1
MD5 bdca5c139a6dd060e78339cedf920c99
SHA1 0adadd50d0de599f2a056767fbab75277054c2b2
SHA512 d41452f3f90f21b778b65c603ae696ba285f508b8870d74d52b1508ff2894ea9f83d255fa507a6499487fb188fb78f75017028db4fbfbfff29896aea558d5f86
SSDEEP 12288:dSsyLCFBoPLCRyf6NQ4tPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:NyLXPLcM94tPfJ4yL/tNCJPXUQrPG
TLSH
T1AD25E13EE66C04E5E47AC27CD6928506F6723CAD033166CB19A094792F6BFF4693DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 4924bc1b64bf335930f646e00041bcd7e113773130f279e3944b817a8d27f241
MD5 271a1c00bfa8264785425d31ba4e49e2
SHA1 7396ab045a26fe6d825e3c879dcabb9d5186d127
SHA512 b25b229741903ab0c7d648fd6d60ad12f7fb93a72191b9c9a89686d9d95616a87ec067a1b0a0ad7efc8c17eadcc5c9b7779019f87cfe8ca7d181c8b590617e8e
SSDEEP 12288:z9lyvj3IkxjbBz2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:zWv8qjp2fJ4yL/tNCJPXUQrP/
TLSH
T12EF4129F12D464D8E83983B89654D111C231BDF6132AA2FF75C0E8BA1FB9AC1953EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-170-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/648-164-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/648-182-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/648-286-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/1116-248-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1116-118-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1116-124-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1116-126-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1488-36-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1488-27-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1488-26-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1488-130-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1548-225-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1548-104-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1548-111-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/1548-113-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1656-201-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1656-475-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1656-209-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1656-207-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1880-183-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1880-57-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1880-55-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1880-477-0x00000000007D0000-0x000000000096A000-memory.dmp

Download

memory/1880-50-0x0000000000E90000-0x0000000000EF0000-memory.dmp

Download

memory/1884-73-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1884-71-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1884-64-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1884-188-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1884-479-0x0000000001560000-0x00000000016FA000-memory.dmp

Download

memory/2040-58-0x0000000000FC0000-0x0000000001020000-memory.dmp

Download

memory/2040-45-0x0000000000FC0000-0x0000000001020000-memory.dmp

Download

memory/2040-60-0x0000000000760000-0x00000000008FA000-memory.dmp

Download

memory/2040-61-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2040-38-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2040-39-0x0000000000FC0000-0x0000000001020000-memory.dmp

Download

memory/2380-8-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/2380-70-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/2380-497-0x0000000000B90000-0x0000000000C52000-memory.dmp

Download

memory/2380-476-0x0000000000B90000-0x0000000000C52000-memory.dmp

Download

memory/2380-0-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/2380-1-0x0000000002510000-0x0000000002577000-memory.dmp

Download

memory/2396-213-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2396-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2396-93-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2396-88-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2904-283-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2904-330-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2904-492-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/2904-287-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2904-493-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2904-277-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2904-312-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2904-296-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2920-450-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2920-180-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2920-174-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2920-184-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3152-485-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3152-285-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3152-158-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3152-483-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3152-162-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3444-265-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3444-271-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3444-273-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3444-491-0x0000000000C40000-0x0000000000D60000-memory.dmp

Download

memory/3444-490-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3500-131-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3500-252-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3500-480-0x00000000008F0000-0x0000000000A02000-memory.dmp

Download

memory/3500-137-0x0000000000640000-0x00000000006A7000-memory.dmp

Download

memory/3500-136-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4128-110-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4128-19-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4128-20-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4128-18-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4128-12-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4264-226-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4264-487-0x0000000000680000-0x00000000007A0000-memory.dmp

Download

memory/4264-232-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/4264-478-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4264-234-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4292-494-0x0000028F20510000-0x0000028F206AA000-memory.dmp

Download

memory/4448-488-0x0000000000C50000-0x0000000000D70000-memory.dmp

Download

memory/4448-240-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4448-250-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4448-246-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4448-482-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4484-264-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4484-481-0x0000000000C60000-0x0000000000D80000-memory.dmp

Download

memory/4484-147-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4484-149-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4520-83-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4520-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4520-91-0x0000000001E00000-0x0000000001F9A000-memory.dmp

Download

memory/4520-92-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4520-89-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4520-77-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4768-260-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/4768-253-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4768-489-0x0000000000770000-0x000000000090A000-memory.dmp

Download

memory/4768-486-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4768-254-0x0000000000A50000-0x0000000000AB0000-memory.dmp

Download

memory/4780-236-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4780-214-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4780-215-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4780-221-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4780-238-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4904-505-0x000001C03E1F0000-0x000001C03E200000-memory.dmp

Download

memory/4908-191-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4908-197-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4908-190-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4908-474-0x0000000140000000-0x0000000140102000-memory.dmp

Download