b53a72842a66f26c9584fb84ea89337c55709907fc2bad6dcee4ff0239dd202e

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
Size 1.8MB
Sample260415-sdsvxac14t
SHA256 b53a72842a66f26c9584fb84ea89337c55709907fc2bad6dcee4ff0239dd202e
MD5 27351537af1a55380a03b1476a55b9a7
SHA1 5ba5fa72fe97c5bfa9568f7ea7ef72e84b66528f
SHA512 da3073556e0436056f85f6504a8c4b2e5488304f57902a2f3595cc97e77a5ff44790a5fa8509ff406038debe410f36eaec6ece9cbc470dfa62a507152df2c42e
SSDEEP 49152:iIf0jsaHk3OMjUfkptVxX/Fj4MYPVyGLV:iIf0jDEtjUu5mVR
TLSH
T19095D016B8E6C171E8A351718EEAC25C6274E0AB833645EBF6CC901B9F655C18733F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3116	alg.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
2628	elevation_service.exe
3268	elevation_service.exe
3084	maintenanceservice.exe
4812	OSE.EXE
5032	fxssvc.exe
4972	msdtc.exe
4080	PerceptionSimulationService.exe
764	perfhost.exe
2264	locator.exe
1888	SensorDataService.exe
3312	snmptrap.exe
2376	spectrum.exe
1264	ssh-agent.exe
3152	TieringEngineService.exe
1652	AgentService.exe
3432	vds.exe
2272	vssvc.exe
3996	wbengine.exe
4928	WmiApSrv.exe
4896	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bfdb3666cd1bad80.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164875\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3380	1908	WerFault.exe	79

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047dc7c0deaccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c445d0beaccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008849870ceaccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000142be50beaccdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dd2ed0ceaccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfa0fa0beaccdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
4740	DiagnosticsHub.StandardCollector.Service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe
2628	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1908	2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4740	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2628	elevation_service.exe
Token: SeAuditPrivilege	5032	fxssvc.exe
Token: SeRestorePrivilege	3152	TieringEngineService.exe
Token: SeManageVolumePrivilege	3152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1652	AgentService.exe
Token: SeBackupPrivilege	2272	vssvc.exe
Token: SeRestorePrivilege	2272	vssvc.exe
Token: SeAuditPrivilege	2272	vssvc.exe
Token: SeBackupPrivilege	3996	wbengine.exe
Token: SeRestorePrivilege	3996	wbengine.exe
Token: SeSecurityPrivilege	3996	wbengine.exe
Token: 33	4896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4896	SearchIndexer.exe
Token: SeDebugPrivilege	2628	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1956	4896	SearchIndexer.exe	108
PID 4896 wrote to memory of 4472	4896	SearchIndexer.exe	109
PID 4896 wrote to memory of 2268	4896	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_27351537af1a55380a03b1476a55b9a7_amadey_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 840
  2⤵
  - Program crash
  PID:3380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3116

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1908 -ip 1908
1⤵
PID:4468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3268

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5036

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4972

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1888

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4216

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1956
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2872 2884 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2936 2932 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 60775744a5039c4ea63fb9b10c1a7b748b09f8cebb79154c0263c17086f3eaa9
MD5 06608a03d7351144958040f652dc12da
SHA1 5fd08ae588aac76419511887f8edf31044a9b45e
SHA512 bdb1a8b0e35ef6791741826b92d6d3eb8baf1e3d0065bee06fb4f34e6c47a1978714691ef235c7ad05216b462e2303a125b950b496a4eae15a3b8e4e69b93022
SSDEEP 49152:jb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1j4MYPVyGLT:B3q6HjBFVX
TLSH
T18AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 cfe7fddf6e8dd4cf473f375f87f5ca597b8a28204aa1a65802e9e826db622a98
MD5 33e959a25d7b026195bc4120ef46d616
SHA1 c2eadafbe23dc4417c8223573c4dcf2619671bb1
SHA512 b41bff5693a285ef053aa8fcf1db9d6c49caeac221cd9608ab75cd3ecebd50c94b1f97663b7ce1095153db720e7d6978187e627ea4839a52bbf8256d38adb9c9
SSDEEP 12288:+1XLsswWkxy2lRq2czAA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9C:MXYfDtczATSnnrFb4PM4MYgLxEVyGLM
TLSH
T17265F12977E408F9DD6B8278C9A28545E633B8518760F78F03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9f25f8875452a5128fe09e05af58b02e6b1ef321a78ef29ff0c06693de584216
MD5 dacc20dde228a468ce19f192c308451c
SHA1 27d7ae463e1de11f18ce03bb81e8c08c08d2eb2c
SHA512 4f9a06f6d1571c2ee9a8bbeb6ba685e744acf920f03326746d4b375d7037748e312b8fe4f2755afc2da5e3fbe7b30a79178c5456084be60cd31bb2fd784f5065
SSDEEP 24576:90Le5ji0hmxirMCSnnrFb4PM4MYgLxEVyGLf:9Pji0Ac+j4MYPVyGLf
TLSH
T19F859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bac0b10300ca444312edf96c41ab3a90000ff334fd9491f36d60d78e67ac8e01
MD5 5e51349b94faf05b017770797d8e37c7
SHA1 f8df824357c64e987a8bfaaaedcc4c0e906d8f97
SHA512 a67498e6036d36cb884d3bdf63821bfa7593ca52de5f281ccf34b68d4242d447aeb06757a3d7f809b3cb6decaf3d61466ef1a74b471fa0dbeff251d6c49a808c
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuoSnnrFb4PM4MYgLxEVyGLR:V/ezSC6vUzPvxHjyCj4MYPVyGLR
TLSH
T1DF755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a528ad8c459f04f095070adbce84f8d3075297756c0514072739371d3de7df0
MD5 33ca3be2b9b281c8ec0087448a275ce2
SHA1 47284e7cbd3eb1c44114baca1ddcfbd308b7d85a
SHA512 eeed1d2dc60da3b2d6914fe72f51b0577ab04e82b66d2babfab08b22ed537874fc06a99ef1092979c925167c296f43aa6ec064f601b7d2966973b3d45690ce04
SSDEEP 24576:3VbqPb88hv/l+6PSnnrFb4PM4MYgLxEVyGLK:3VO88hXl+xj4MYPVyGLK
TLSH
T1CB559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ce1ed1c19a0cbdd25b44ef4424da3e842661f3b8928eeba3870ce1d17aafdb19
MD5 0d1f9b0da968eda1b16188562509f413
SHA1 ed8afa5f9c46c4ab0c3f6a52db33cfd9203ebe9c
SHA512 fbc1672a8d9d2108cd1cc4e1ba25b15e2412024efae392ff69f815706790fd92abfebc141e76660eb91bf2f18d06971ba8994b653e55c977bd91c8bfddd27b86
SSDEEP 12288:7Rp34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:7RuSnnrFb4PM4MYgLxEVyGLj
TLSH
T1074523A72BDC10EACFAE15B0D1B96AC8E205BC61F875B10B6750785B363F60DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0f4030b4ca76bb5cc2d9446a2930a22c9515128bd7b077375fa7930b637414c8
MD5 1873c81349ed4cc7a98567a759c7f70a
SHA1 1f8ec1bf1636b5dd222645fa458f17132106bd43
SHA512 e89ad4419ba7fa1ab5aa02613c7df971fdd52dfa62e599e56e176e0f8b078e86459d1062ea784e3d4aad302d2aa7b745f9e493af08732b6ed7b4d4a06da98962
SSDEEP 12288:CeBNUbTVO86UM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:CJIUXSnnrFb4PM4MYgLxEVyGLu
TLSH
T12065DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5df4beb525467b4f692d7e7c51fe72addf45f478719c049889cc3c0ac2110fe0
MD5 95ec196ce99b12d0cd2a346738fe2c75
SHA1 d8ccc490a649da121231e75154cf17cd1c8eb57d
SHA512 4997d6a68e91aa7d974fd82bdbf01d51afee4f6e9407b693171c67aa0e5fc4ed5e821d388c9b681a43fb63198b6de3719d71b4d3f2d29ba0869e3e3c3ea3ec4b
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:uQvGAdlCEL8c/yRNw5CoVu
TLSH
T143267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0e17b71e4344b5af6049516ff2123023787bfb37ff8b282f5fc46b6d4645a9c0
MD5 3f2ac52e2ac512324e40a6c0a00302ad
SHA1 771f5ff6e5d46d3ad34fb2a4b183ed7863a53f52
SHA512 77465333df391b122560e72e045d9bd5247cb3ea3fc8ee897dd9741cba3a7f50a71ce57c3bdb8b5b4d9deb99056bccfa8fe50a176f376ca885d729197420974d
SSDEEP 12288:ZAwSfxL/2Dc34DLLmt0LDQewsAje34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAu:KdewsAjVSnnrFb4PM4MYgLxEVyGLB
TLSH
T1EA75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 15ff8bc93d2276e792aa519f350b68cec81c2201c09392eed389b3c086f76389
MD5 aa1de4423983818585bc2fb9c14b52e9
SHA1 79612c5a0529393b0a805efe09b808b7b2a315c0
SHA512 82f5dbe34893635d16cdb230ea05a5c987e495be2a9268fbef560a748b4ea8c7e3247ee79a980b1e2cb148f63f755d278eee994e0d28dfda68a8423085977fdf
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:qUEtQevvqc2W1cpV2EI32
TLSH
T134474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1e2e23d8cae9c0b849b0cb44b7eb3e5cc98b4072f03d97e47af36018196f6f93
MD5 d5f80953024ed0841c79c3f1d10fb285
SHA1 1280cc6b3a96bd40ba28180c51032bf49acd354f
SHA512 d53eca6f4c128bb0742fe92ffd859761b7b33e6cee290d26195f2f3894a75859f7d471ff3f0fea49f3c5ff27e00e1744333ef1eb1aacf6a62dff8a1a7445124b
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/zOj4MYPVyGLj:OoqtVjnmcVP
TLSH
T1EDD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6c4b088163e97ef24b5f34d40057d6867513c4fb91560dddfb06f1b17782cc08
MD5 da7464c053b1c3ed6dfe7cb5bf7a9819
SHA1 f1dfcf250b5fb5b0300d3abd698a409c34c872d7
SHA512 480918459bc492c7ba63647c6bb708f5dc93c2020e90892a57b80d7692af8a1d2923ed69cf685252c973d7a31c039f9a2ac0e5ce38390f8b73fc0df2718c9677
SSDEEP 24576:fAhGLJIFoiwtA5l7S53sSnnrFb4PM4MYgLxEVyGLq:fAMyFoiq5vj4MYPVyGLq
TLSH
T18835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 bdc9c105440f5429ca734086fc474721d72fed2d58558a923e8d4004e6667e8c
MD5 b48be4383b8365a5b2c5df7d41bc12ab
SHA1 67beb255648c861630c3826ff365463e87f581af
SHA512 0b39f610e7765a3497986cfadb2e7096210c6d073729fe9fc3db46f83a778bc8ab304982267931011545ae7678672821975765d61df68d9555b8e987bf4ba6fc
SSDEEP 12288:7mw5HEjsChNVBFgl0WDm+CH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqa:awuoOWpSnnrFb4PM4MYgLxEVyGLs
TLSH
T1B865F04637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0d53f81e9390e3c233fbde4c7470fd4fff00c63c9075aebffd8376618f831abb
MD5 074e2be94dcd3e78b861c85210dc73e6
SHA1 edf99e7962df6c5110a6cdafccf7b02896e6fae9
SHA512 5278f92bf5c4a472e04c3df3609c77e339907f0e414156076aec3493bbaa6fe56f99764964a6250ed01ec5d530edb1c1ec945f558d7c74812b6d751ca0e380ca
SSDEEP 12288:kBZ1IyO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:CZuqSnnrFb4PM4MYgLxEVyGLj
TLSH
T10B5512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f191776d2461c2e4dc11ed5f1539be24672e7b4502a9f73082281db420fba985
MD5 9cd50331469022dbb2b3b38b668074ec
SHA1 3f0736da12a649da689e72f0db489d39a0824a19
SHA512 aec8fe8e28ed96a656e9f47b1448f6180c12825593ad58c7b535e1d936c89ca6a295944b09f32d4890f311cd043f4d084b20fc2cc3d042def2d2fcb4825c4d04
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UO:HQRQyi36YOcPQLvw2gAf+PN3hVu
TLSH
T13B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d1c3b425a479604e9da2f10797f2588901fa175e65db59b2f735b974798ddd46
MD5 03ab84cd902e6fab2663edd98ecb4578
SHA1 81ed2a3ee875386b691bbe0cf0971a2c5633c687
SHA512 9366d01033147ac82205c73e8326cce7dbc00c52f9396e2667e16c1168e19e5f432d4a98e909f6273c558546364e8b83f308bad33c450ebe664d963f4b413b4a
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:nQRQyi36YOcPQLvw2gAf+PN3hVz
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 92a43d74abcb644f86d9a4db01b592142b4723e03f6cc7dddc6dff093c69506d
MD5 673969d109a2170b198471ac060ab811
SHA1 5952735a887f17a8bd22ba4c3f732d4d0f383049
SHA512 f9dd2457b01951e7af8d63727e78bc101379403ab3acd926e3d27b479df7575fe18da5c01122550396ec82931e7426ef1e6d693deac5b31786947685d5aa01f5
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06SnnrFb4PM4MYgK:M68Qg55nhheWu7PNU3/+j4MYPVyGLh
TLSH
T102B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 13c36643350c41d1292e3015655589af04b4f7b175aa4f34c296dbd66414fc15
MD5 f78be0db0e9f42a3111f6fbc0550960e
SHA1 75e881c20f47526d7b1849575a84f6f5b40c3962
SHA512 62de2a5ad753c834f4bd3ea3974b390b0ec3ff65f3de92a7651b0b3fac1bf52a0805033083f2c541a8edb3a8c021a944aa9c7c656165573cb363b5818e70d2d5
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:iy5112gYy5azzVvL69nLKnhZSVJ
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 61bab2b9b3bbc7243e4cf6948ab1f0b0133970b1d29bdf848a92eb3ea800d3df
MD5 e848bf1623237e4e4d85408c3366d9ea
SHA1 ae68703fed4d487a44deaa605959a84d8e6e982b
SHA512 7002b9f340b255ebfa3a3ddb08a150eb5d873403ad46b1331920137d59f4a7e9c03d4f008bfbb54c435f97ae5953f5174b25781ad7a97110aec2d173f9272bcc
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsj4MYPVyGLz:Pu6JmVxd2d5VX
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9932593a3004b2079edebf81c7478a3aeaf4d70ac282bee8c060575bbdb391ba
MD5 7f3dfd28d383729f890b5f78ec6d8a19
SHA1 e0ce15145ad837f601b5bc761d4b71dd325c055a
SHA512 77f6efe8d0038f1077dbc8a7aff12e21384ab571c18adff22af086d2fb4aa9b90e1dff763330b8d5f791f79182c741aac65385b787314eaf867b242d198c8629
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4xwj4MYPVyGLq:imifPbRcVW
TLSH
T1F4B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 077d26a89355e54ac504158031bdcae969cfcde9678c74c680da0feac637738e
MD5 1764d64e8a825ad196aa15af527304f4
SHA1 dca7dfb13cb2d7517755228adcdb9f05bf0d13d5
SHA512 326a455833a5d20c138ebc7ca470fa28c5ba5db212d212f7c2632cc41f779e734a7cf8a50ff99c3792851aa6f6fa9310900500f534e73c03888f0b1540d535cf
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqlj4MYPVyGLy:q5dKTi61+VO
TLSH
T113C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ceebb3857c87c2ce75102726b4bf5a1ce63e7938c2eeb4b3b6ee6753698ed51e
MD5 a785926457b1a0741242472b7436443c
SHA1 9978969e3c2c720d986749d9e2c700e7e9a05a46
SHA512 3e242c8e5b968764b2256ffd1d8012b0cba6a361780e4e0cf32298f72c69d4c23ee2413b1240fcc2128a408992072cb092a73bf046623da0e966acc455a066eb
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wcj4MYPVyGLV:fX2iyphwV5
TLSH
T13295BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e0b53adf19cbb876a6c338251527638ff9dd7877b82ffca2bd4c73185d9cae15
MD5 25d2aeef26795da5190bbf801eb4f392
SHA1 aa8b7336075899ad182ddd383977da0854ba3cb9
SHA512 a238c2c546360e4194003b646921154993b9503af3789e68f863baa4067e00d192ff9616ef5b256f2d1d090931c60877b7f241aff2200230fb1b374063562233
SSDEEP 12288:8R34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:8WSnnrFb4PM4MYgLxEVyGLH
TLSH
T1AF4523A62EDC10EECF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B60D5892722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f5ed03ad1931f44a2224ab7459b1d68c6c77059a366ae833816ae3213b227d68
MD5 65fa5ba3a129897197651ba21ccb6121
SHA1 22eea115be48c63c9c37a1b1ed47ce58635ab8ab
SHA512 78e2b1674642308a9ccc2e89a74876d8a3542b542d143c09c84d20b50193d34a5c7b5b66d3025e0ca33eacb89c1c6c14e99023acc10366d27276f9b94b764773
SSDEEP 12288:Dy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:DBSnnrFb4PM4MYgLxEVyGLH
TLSH
T1964523A62EDC10EECF5D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3680e4ef2f111905339b24b108e425700a42b396fafbd7662e451f4790a468bf
MD5 904f96ab216389090dc1153cd599b8c5
SHA1 746b81c3b724e00ac8c78a55b19f07da1ed0fb56
SHA512 6c5bc7d7542fb3bcdf1bc58026fd8571164237b1ad86ad1db195ef4ddf952683819786d61ef957cefe630467ae4fa42ec933acb317baca7e33ab7c4e55546c9e
SSDEEP 12288:rU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilr:rfSnnrFb4PM4MYgLxEVyGL1
TLSH
T1294523A62EDC10EFCF5D16F0C1A666C8E2057C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 ae8649bef32867d2ae959f3b2f5f58fdd5059c91229a4b43ec972a93add86785
MD5 689b199e0f8a99cd7dd12bed6587ba29
SHA1 c76b7a6b2d5493927e75a0c721e5a01a83b14378
SHA512 cf10db3a442fdd105354fcc3cbb8b92e9975c8359d2c5d30de534841a8721fa73082785c3338429c2b6c632876fb30cf3e0d3adfe258a45c9a4c0cbb3df12458
SSDEEP 12288:tVz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:kSnnrFb4PM4MYgLxEVyGL3
TLSH
T1434523662BDD10DACE6A96B0C1B556C8E225BC62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 439085b0700faee5da6b1fdf229601115490ff49fb3d1f124871b9d3fa56a235
MD5 a4b7e39f5191b052a8941163c7048f08
SHA1 b7cd6b5d8db2b3b3af797fcee686a290a4fc5de3
SHA512 c7862b0a5036cd3cda3c45428975c9ca3b7e9e88e70b24cd923082f3405d23b136aebd4a8d007824529cab52598b850fe0c9431b18f4bd75339bb1b7b4f7641c
SSDEEP 12288:9L34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:9ESnnrFb4PM4MYgLxEVyGLd
TLSH
T1A84523A62EDC10EECF5D16F0C1A666C8E2097C63F976B20F7B4574173B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a00995f46849b8e31e560bda0076416d1217fd701d04a7d4b4ca13fcb841c880
MD5 f788509b8a35ad94478622ee21c1231a
SHA1 7ac80b632957ca3956507a94966ff0beb50cbe5a
SHA512 e2157c25d1d95680d9aad9d3b308686a3c2c347cc7618ed6a115343accbdde20b7c3c9766341e4c5aaa699d9406edac75ace91677bbf3512339fb14888e9ce09
SSDEEP 12288:cm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:cdSnnrFb4PM4MYgLxEVyGLs
TLSH
T12B4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6058cfbc09941e5ef15a3f17c3dc992f36d0b357f729af4972a56a1f66a555c3
MD5 3e6330ff94e242443eb43f958866e718
SHA1 f4f3b9b1dfb680be6d15338c23e2a9ba967f1daa
SHA512 5136adb69400af8fa48327ae84a7baf22ee32fa4803e72392b6ee861d22a1cb37017ddb2c763165a19eb248c163367c10f002403d50aced9556e6ebaa5dc8f32
SSDEEP 12288:sK34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:s5SnnrFb4PM4MYgLxEVyGLV
TLSH
T16C4523A62EDC10EECF6D06F0C1A566C8E2097C63F976B20F7B4574173B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 bd744639a39551eeb6b7f339e2c0c1d08330875c98f05d0db39d1be9c717cd86
MD5 a3af18e9078aed2b79807b2ba17bc8f0
SHA1 6fe4f3b50574010e9b51aba8a9c2167fdb50064c
SHA512 e09291cbc975130512c385ea60e6175d4255b7b9393573fb2e6f994278586f04848f51c4b92ce81c7e9c2d22a36ea0acf88f1ed2a42b3470b53eaad73f92f691
SSDEEP 12288:ciZwb6zzFEoS2cPvyS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r22:/ZMSzFVSOhSnnrFb4PM4MYgLxEVyGLz
TLSH
T1F66502A5739018F8DD67827EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 29141d48094a50bcc5a26cc37385be79fdf6d46671817c4da5249bb92e5fc511
MD5 b41ef10eaf6abb9258f4fb2b9ed18c72
SHA1 fb06894dcf4f8a1da35b9bdadf59e90292892bc5
SHA512 c0f0e9092e3bd54b4e55e2fb22897fcdbf06cb6a478277d334ace4c38fc1ea63f1ae26322aa0b74f36ee17fbdcd10cd659867f6d3fcac79446e4da4a555feefb
SSDEEP 12288:Bd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:BaSnnrFb4PM4MYgLxEVyGLz
TLSH
T1AD4523A62EDC10EECF5D06F0C1A566C8E2097C63F976B20FBB4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 edb30b1ed209740879cbfc3c7330a71a9d4b748bff22d8e56d5d95826e090970
MD5 f76388cb2bbda2ff6e5fe44872a4b713
SHA1 c0c8e4051ab510b5f03cdb4b8239b21263e1e0d9
SHA512 1266fbcafd5a221ac5d9734b33d04251c19e6d47a828ba0699173b98cf9a2f1ecf8e866a35b571811e14a62b55b547d3c8d8c44068feecf1ce7a72c294b412d7
SSDEEP 12288:mZ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:meSnnrFb4PM4MYgLxEVyGLN
TLSH
T14E4523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 738b96f13954a670441a90b2dde0ca1a7b31dba123fcc0f13b1a227c691649ef
MD5 1b91d54f1308eb118318037e84c5c02f
SHA1 af31f8a475052cf0b66ee784c9f2a93f4166794b
SHA512 7ad6986c4acb8339a74b892ccf3318c14dce14f7c57291625ac686ab4f9b9e8d2da1c590248c4a10bdd3b89bdea7060beac8b1dd46230dd95baa91be3d4909e4
SSDEEP 12288:/yPz5L8O34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:yzyFSnnrFb4PM4MYgLxEVyGLs
TLSH
T14055025737E530F9C67A8274C4A21A45F332B8329B309A5F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4326965f81ff2530ea611c5039d78985add972601f839cec7adc79b27c897430
MD5 d2a48a2ae5a688ded9f0908609818930
SHA1 1a90d94ea700c0730cfef271613909260e271a3a
SHA512 e525cc08b6d9956bd1b1dfd95619b9a99f1a812d4902fa1fb61024abc9b9e51239c9a38e2f5e3babde081bc20e3de2d3b9fcede04e345a848ea48fc8af1d8bf7
SSDEEP 12288:gd34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:gaSnnrFb4PM4MYgLxEVyGLe
TLSH
T17E4523A72EDC10EECF5D16F0C1A566C8E2097C63F976B20FBB4574163B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e095800720667f50d633fbc5a32eeb9fb4ecc0b254fc0c55679a7b940e50b1f8
MD5 a168f5bd02467c12edfcfed9116189f8
SHA1 f1a839150f1c150d62095c5a9b7e8b452647f2b9
SHA512 b73def7f8f9feed9c8d520b917a783dff89ae18946ffb347137bdeac0c0ec8ce351427a3edc249b35672ba04c4cb65c23d513c1e8fa3d2f7d41c5e8e3ab36583
SSDEEP 12288:Id34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:IaSnnrFb4PM4MYgLxEVyGLK
TLSH
T14F4523A63EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574163B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7cfcab5fa72709ae75b2aba85647561612533ed048231747a4793c569c956460
MD5 342873f9d59df603482a78da6cb34835
SHA1 61d31ba4122339547166e06806ad0840f11e1a15
SHA512 c0d9aaf4953736e3217e1db659f57293b1e3188c6fdd7734e748eb472b3e67a5763cf66fefc1c2f305523d16b9289726e224b9db9033a4fdc354649a5de2b4ed
SSDEEP 12288:nyPz5L8O34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:KzyFSnnrFb4PM4MYgLxEVyGLA
TLSH
T11E55025737A530FDC67A9274C4A21A45F332B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 12b0156e4bd28b11697db59a8c5527ee887f7f083a7919be4c5d20830d031dc3
MD5 ca4eb9109626406b9fa6c4eb7a201297
SHA1 cc05eb613cf331882dc997bb81b542ef1b7af0c6
SHA512 f69d058e144f029e36ce1587428e13d349096ae974fe9af27177326dd7c7987e95494636cd8eff7a1d2f55c6debe74dffe265d5b7a40d49a0f255ca4c3605a4e
SSDEEP 24576:ZTHaLl3z0zDvSnnrFb4PM4MYgLxEVyGL1:ZT6Llj7j4MYPVyGL1
TLSH
T17F6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e27180ab8a689a7178babde8bd2859d269daf507c8926259a7e488fcceab6eab
MD5 0a7c785cde4ed5f2a563299ad18f44ad
SHA1 c9cbef033f54051369a5c20789bfd2d4826eb3bd
SHA512 eb7f3c79e027a81fb3de7f2fcd4fd8504c7977f250940b8d054e1770952a6134679b2a8125d06abfebcff6c3abd7e0279e485d084f8f4099486c359df6095ffc
SSDEEP 24576:A37d9CHKy7GZ7SnnrFb4PM4MYgLxEVyGL1:K7d9CHKyamj4MYPVyGL1
TLSH
T1CA75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 66fd73bd7a522b9156ad48dfc78830badc9eb4a642d056d13cf2ac6933fe92a5
MD5 d2014a70f20503a4e2451d90ea67da3a
SHA1 8a2f0181116404ce27b5f0111640588deb9e1411
SHA512 2c1fc33394b97fcda7d5ec1e1c183fd124a0d8c36ba2c20178bb104cc39786059d5925f92a4dd18f0f70082a65f19c5cb28ff1f125b231ec4d5a667d2e1551ee
SSDEEP 12288:2034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:2/SnnrFb4PM4MYgLxEVyGLq
TLSH
T1B44523A62EDC10EECF5D16F0C1A666C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 de75e46dfccc744a7e1c2c6bf9b61475f6d4d07073e22ed6a79660f3794c77d9
MD5 fb1e728990bd36d08df7db9c92ec164b
SHA1 d766251391c8454c66b8812f7dddeb0aae25b154
SHA512 686161dddeec54238b8c2ec3381995e10e97f3af729067ef686f02f490959a3f52bdea9822b87120e11d12501119d0fd588a0580fa18a0f02857f3991b8a0341
SSDEEP 12288:zu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:zlSnnrFb4PM4MYgLxEVyGLY
TLSH
T1824523A62EDC10EFCF6D16F0C1AA56C8E2057C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 740cee5dee3d16d2da1d65f78f78900c4455762b07193868785bf4a934b23431
MD5 e4d8acc14d15c3a8ad40c31393c53065
SHA1 ba3dcf6d0ecc6f160e1e56928d10a89c69cb4271
SHA512 3ebcc97f8938979cf6c600c7a9e98e716f8fa6d9372e2b676f7f6230bebb985164c6b7976f64cc73e0a42b4576770fde12377c026f3919ea46e97cfc6d4042dc
SSDEEP 12288:hNsft34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:mqSnnrFb4PM4MYgLxEVyGL5
TLSH
T1D755F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ca9f0a0f6b9a4928f9127f15a589babd09c4f3cc6e2d21455029f009d9e7e14a
MD5 934b6b7df3db024f1db44b2088e05d42
SHA1 2fdd48b507f8a6eef4b85b62e5143bd4716defa7
SHA512 0cab84a03ee010c231c8e7b1f8845e64307ff1ac4633d6c8555c51905ab9f17cb2da429c26bc0c2b4b9bc0b3cef08adfafe4f732e94252b73dcf90161acb75b6
SSDEEP 12288:R234XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:RtSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1754523626BDC14DACEBD16B080B95698F20DB861FF71F18BB740744A363A6C99CB1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 91a6a43a97c0209891ee18507f282e30cd1ca3de47d0ac99a6f58f9b84e5710e
MD5 cfb287df1dfa63d6adcbe947a8726f50
SHA1 cafd9abb88ae0230f3a1c7bfaa3b4d451f2b0d9c
SHA512 5b8aae14faebc88bf9aef41f8287c859ffc1f5e20879eb6122ef6cf53c1a452fd5bf70f2d380bdfaafb094ae9a006483bf140bc2d0d57af484dd3c4b14a88d6c
SSDEEP 24576:88RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCvSnnrFb4PM4MYgLxEVyGLD:1RZwQCyiHiQEaaPnMHj4MYPVyGLD
TLSH
T16C85B01E63DC46A5E0BAD278CDA74407E6B278165731A3CF1190C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 5b20ab055921f88301013a8c67786b549dbbaf2cf829ecb9d52c673a45fb21b6
MD5 4445db5d29a3dbe21d4ae5fed44da328
SHA1 ba77b6848f15cd70cf0676f21f85d4d1e88b518b
SHA512 84d39d0155b3288bb36ea4913d23eb8b8731a981e2fce35adea8baf1ed0604145dc436239078f7bbe4032e04073213542c2e3f563df3ee70060acbd62693b632
SSDEEP 12288:JbxA1U7Kk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:JbxA1UGvSnnrFb4PM4MYgLxEVyGLX
TLSH
T1A155127E26EC14E5E67A9174C5E68245D331BC22A731A3DF21C0913E2F3BAD85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 167a78e299552b44a5fa34214bc9a8fc66664b466cd673bde3fd02eea141c6be
MD5 21306f768a673a4e512bdefa8f06a0b9
SHA1 e51b4a582ce3f2e622d25f9cd15819b17edeae8e
SHA512 cdd9f93fa926fa4d063f0e47f938a4776999b637b0c817c4f1c041fbeeefb853ddd7084e0a2645e22550f754a2d9bc4dd05b4ebb4ffba132c33f5799478750fa
SSDEEP 24576:DjsmP0yHaqrVqHra44KDzMsrnKSnnrFb4PM4MYgLxEVyGLY:DjRP0yHfVqzlAsrnFj4MYPVyGLY
TLSH
T19845BF2EF2B910F9D8AAD172454107B5FB71742D1F209ACB0170C635AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a8120c694b4571f42e0de2fe5e135c2ad2d08ec89b7c864942420277d27deeb1
MD5 8128611688e2e221324dd5dc91e4b150
SHA1 313a402e10890ca8b6c197c440f6bd29579ef0d3
SHA512 98fe21199b3aa22e9586047fa4000cd2fcd49b539479ca50cc97b725122f6805c4bdcdd9d7a7c03a77edc7ee8cee8f8e32ff7d3e0544422ea8ceb28f96f10936
SSDEEP 12288:G834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:GHSnnrFb4PM4MYgLxEVyGLc
TLSH
T1E94523A62ADC10EECF6D16F0C1A956C8E2057D22FB76728B764074173B3B68D9CB1712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 56d4fa587a6e3d80112b132a5876b0f3aa95b46d2019499c42994fb379df9b4c
MD5 063e3b0a41f62a8f722cf68e99a6a6e6
SHA1 c0739eb128ce9dea3b2b051e0cbaaf2b7445b706
SHA512 9c1819e15d57f2ee7480549104041954d6208f20b5c1cf8420c2cce81eaf2c6e46966413e049860ef23995a1d82f1459ea3ac710efa730f1a8885c8c5821186a
SSDEEP 12288:tOb9A4LWO+vAYFTy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:KpLBUTBSnnrFb4PM4MYgLxEVyGLw
TLSH
T1B0750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 1120c54bf95035434e528938c8ec1cf01aebf71085d386415989e7ddf2e619e4
MD5 4d29c929f1f8c0b16a69feb83922c6ae
SHA1 78b4d663d92fe074a0c9631750ca99cb5d2d2a59
SHA512 7852c89c09d535521a0abc893ecba14b52e88dacc440522918eb91c06a8a41bcfccc1ab1a7c0ad40a28d8e0ad5f889efe01ca3d26dcd3db617bad3a3e3a946fe
SSDEEP 12288:g70VmvIYNvUyBpX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:9rYNHOSnnrFb4PM4MYgLxEVyGLw
TLSH
T1BD65F12F66AC18E5D57B9179CAC38249F27278625711A3CF05A0827E1F27EDCBC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cfd25bb8812a386d7e312fbeb913cdf924e3a2be9f7d31db35b23b142e0e7e7b
MD5 684a6cf6179bf432b9b0333a962026d5
SHA1 f06c9514b66ec6717c07d19f070b36a0bcd18b6e
SHA512 820062edecd861bcb602c0556fd0e645560d20bfa3608b8d7bd305063923b00ef44db528f95c7aa706bd855b93b08b1b90f95cabe97cb1fb1dce5f93077b4fe2
SSDEEP 24576:unXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKw:unXoJJYH84VVS6AmEcJas+cHBjSSKHPg
TLSH
T12E65BFAEA2BC04E8D5BBD17DC5C24506F5B178621331D6CF026182BA3F27AE56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9744890af765329d5487a1a8757d5f53c028347bc91ef716b6c76bc2e5d8528b
MD5 b194c504d8c694dc384ca06174590e1b
SHA1 3753e3fd282d3c6e61ab76a9894cd0cdde43d78b
SHA512 3cdbc1f30afdc9c038492e3e5fa466f95f5aaa0be2286e92a8d60c99939868443d497f52f769d9371f4cc79a9ad036fcd4c3571731f89410542f9e475c7c99e0
SSDEEP 24576:Lv7Xbxd9Tuycf8M/TYlSuxwr2PCwSnnrFb4PM4MYgLxEVyGL0:LDLL9TuJ0M/TYW2Pgj4MYPVyGL0
TLSH
T199858D5EA2EC42D8E47BD6BD85B79146FAB2B855273081CF0250856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 c7c4c02db146c1aa75e4f20d057a08267d67497a15df86a486661792d2b71319
MD5 c30058d8d03b6ab9ca1b25bf814e87f7
SHA1 e21db5e2c6adf6c55c829865233de2ded73c4d15
SHA512 2c8e4ebc0bfd1e0984413b7b327e4ebb45e6ef9ddc077e2ce4fb422d6506cbfca6b38b07a64484ce21f8fadee1dce71be2d7280fde34fbb143c9e25881f31ced
SSDEEP 24576:segJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wBSnnrFb4PM4MYgLxEVyGLz:sngOJOmPOHh6j4MYPVyGLz
TLSH
T1F255CF3FA7BC15D5D03EC17D8A968906F6B1782213356ACF0560827E1F1BEE46E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 2e8494c7da24b9446c10ebf0cba427ca1bc4496a3acd2c44ee176d30de06dea2
MD5 2648b6051efa6f2a57fd6c7a2f51c60f
SHA1 98f7db07f1017f9eab23b91e082585b06013af7f
SHA512 e201f73915aa1e05e6d7ef6e0b18d5bd7c0083c912649c0dc1721ece7e4e9af4337a2ab437f18d1baafce26b32285f343c01f51f0a574c0a041c09d37c679b7b
SSDEEP 24576:BLJnJiTk3R3waE4JrOnSnnrFb4PM4MYgLxEVyGLn:BLJnJK8R304lVj4MYPVyGLn
TLSH
T11775D03DD2A810E8D4B7C2B4815A1B96FF31346D2B2269CB69B4D4313F12FD0A979F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d10840f2245f0bb285a2cf7db2eb6bcf41c4716085fa5a1581c7a0da905e9711
MD5 5052cd4a98f86f4fc502ae91ec405afa
SHA1 aae65c2f50aad22ff526875ae8df814784e2320f
SHA512 a8f13780c66f1ccd37bcd77a5c706408be025e655a09f7f654de02d76e8d956799097a9fda41ae1704eb5c69654f06c18289b785a8ab26fca1ff06e5d805fec2
SSDEEP 49152:09GqCzDScAZmlvTcFg8Ph6cj4MYPVyGLV:eSVB
TLSH
T1A6955C15F7EB5298E8B3CAF1C96294159B327C409B34F7EF0A80C96A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e9c6c29834be957ee2d28a436bca7de82c0cb340a7e4de9a1f127a976fa714e4
MD5 49dca4518bf661ca37d2d476ad5dd87d
SHA1 bbe5057b55068945df0ec2851e4aa07e2cd56ae3
SHA512 cc4333d87ee8d0bceac8c38f2db0433dc61142c363afbed78fff47fd88acdbadd0255c2f7fa4b7571718591878edeaa9b7b157894eaf5f5e4346c7f47b86e7ab
SSDEEP 24576:VlYJeXm5jUuEjSnnrFb4PM4MYgLxEVyGLf:VlYJeXmRUuEsj4MYPVyGLf
TLSH
T1BE55126D3ADC30E9D66E9174C1A24A88E331F471A71273EF52E0D07A1F27AC96D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 1d509f6ac978030bfc6682c5fb5941e02eddce88953d3af9b0d0ad1ce03144a7
MD5 7a44d8e41fa4708a5d6cd85c158ac903
SHA1 1c23be7f93d348e00c6a036d084fc9d7efe46e08
SHA512 d82d139c7c73d35c2e23076d65b2866f76c95bab58a7535dd104b1f1bbdf4d2abd2847c4f3ce5b1d590e8f2676e7a42b61e71fac6afb66cddc81c708b2d4e0cd
SSDEEP 12288:qwu6kyt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:qVtyqSnnrFb4PM4MYgLxEVyGL6
TLSH
T12C55125527D820E9DAB90670C5A242D4DA25BC21AF21A3DF6690F52F3F377C8AC71B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 e7ba3569fe42f9f6fda161c766356377f4931a980fbef9423f620c19da3a6a49
MD5 d1d34e009cbff683c64a5d4309f4657d
SHA1 c6516c3dd7a29cf30a319c9dc05236f83afe313c
SHA512 35248f684690ce2d648f4a4e8ea4a9550ebdac843d7dfe7b9d922796f3a0b6003fedbb552b1aebe105d0dfe81b56458995d3fbc5f3751e53674625a1421a02da
SSDEEP 12288:VPy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:pBSnnrFb4PM4MYgLxEVyGLx
TLSH
T1564523AA2BDC20EECF6915B0C17556C8E2157831FB71716F76D0B4363B3B28998B1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4134b4c0de7db31b4089ac6c167f78fff1c81b8cc6f18ef3b2353fdbebac7fb3
MD5 f50ab10f3d7a50a81f49b600169b876d
SHA1 02a2abe02ef081d3150be5c83ac646083ceb65a3
SHA512 8957dd1972e1e0434c00a20b1cd51ae86124a424ad9ff7f6a20298fd9331c0d6d941ff79a29a3b6f1d36fdaad8cd0ff22d13a1963f02ffc8072b311a8601d9fe
SSDEEP 24576:JC+TyQIu93VAumZr7jmsSnnrFb4PM4MYgLxEVyGLP:J/TfIq+Yfj4MYPVyGLP
TLSH
T1AE558D1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dfba2c5341b1f463f314037053366e60ef16f8a92d9a948d942887e91dcacb2a
MD5 6630bf0643bb010e083ab3d4ffb5cde3
SHA1 a663466f0103c25a00f0cecf742cc36d49ceed98
SHA512 f2b973f9d182add234c7f67e9fa280b06bc4a1005c425ba7f580340d9fd52f77aea26476cde014b6eb5b72a51a0a96e6ed0ba55fedf9f331fa0770203a7ef7e8
SSDEEP 12288:bcyrWOstaa3kcsO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:qLQikZFSnnrFb4PM4MYgLxEVyGLO
TLSH
T19A65F10FB7AE00E6D5AB8278C8954245F6737431972263DF0290C77A1F6B6E9BD38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2c0eedac26598cd96c7537a5d69a6397a17c64ff097225ac4e4fd721216a7cad
MD5 49c365b7f2724c7e6c640e59675b75ac
SHA1 fa048d4c1e23ff24592a0cb4e9835bc42db116d8
SHA512 2e07f31e8cd4506887710e49e586e69443fa271ead96577cdf9bea4367296d77a7df61a491df668efecd468557581ac89048c0e36ca62246d0bd52345bc8acfd
SSDEEP 49152:5pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPlj4MYPVyGV:KpC7b4+80GTkBVN
TLSH
T1DBA57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e6265e359ac7ec48bbb13e05cefa201731d62ffb83096087a80a1d6b8cabd0c
MD5 75fe1946f18bcf5d24ffcc4a61c41bc8
SHA1 8fb8570cfcddb53dd56c77527e088e0c96e5744a
SHA512 1cab783137d72cfaca27e4ef3859f4f2fb88dd2c67e406f445200f9e9063a8c33035e497a147250051176794b4d0b83420a79ef09e56fb8f2fa128a052949b40
SSDEEP 24576:8SAwJPE1IDAo+4Kt+l44135UQoSnnrFb4PM4MYgLxEVyGLs:8qPCIo4Kol4/Q7j4MYPVyGLs
TLSH
T10555B02AA7F946E5E17ACBB4C663C601FB727822133163CF5290813E1F169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-270-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/764-275-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/764-334-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/764-277-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1264-310-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1264-304-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1264-425-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1264-303-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1652-320-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1652-319-0x00000000006C0000-0x0000000000E6E000-memory.dmp

Download

memory/1652-317-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1888-296-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1888-424-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1888-348-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1908-37-0x0000000000400000-0x00000000005D2000-memory.dmp

Download

memory/1908-1-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/1908-0-0x0000000000400000-0x00000000005D2000-memory.dmp

Download

memory/1908-6-0x0000000002430000-0x0000000002497000-memory.dmp

Download

memory/1956-449-0x0000022E47950000-0x0000022E480FE000-memory.dmp

Download

memory/2264-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2264-347-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2272-428-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2272-327-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2376-294-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2376-288-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2376-297-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2376-421-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2628-49-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2628-41-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2628-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2628-238-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3084-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3084-74-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/3084-85-0x0000000001530000-0x0000000001CDE000-memory.dmp

Download

memory/3084-69-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/3084-63-0x0000000002260000-0x00000000022C0000-memory.dmp

Download

memory/3084-87-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3116-137-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3116-16-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3152-426-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3152-314-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3268-239-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3268-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3268-52-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3268-58-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3312-298-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3432-323-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3432-427-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3996-429-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3996-331-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4080-256-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4080-262-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4080-330-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4080-265-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/4472-453-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-458-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-470-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-469-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-459-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-460-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-461-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-462-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-463-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-465-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-466-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-468-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-467-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-464-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-455-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-457-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-456-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-454-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-439-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-434-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-433-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-435-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-438-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-437-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-436-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-447-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-448-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-446-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-445-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-444-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-443-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-442-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-441-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4472-440-0x0000024F5BF20000-0x0000024F5BF30000-memory.dmp

Download

memory/4740-30-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4740-24-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4740-32-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4812-83-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4812-86-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4812-77-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/4896-419-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4896-387-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4896-345-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4896-349-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4896-339-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4896-403-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4896-431-0x000000000C1C0000-0x000000000C1C8000-memory.dmp

Download

memory/4896-450-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4928-335-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4928-430-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4972-251-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4972-326-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5032-250-0x0000000000730000-0x0000000000EDE000-memory.dmp

Download

memory/5032-252-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5032-246-0x0000000140000000-0x0000000140136000-memory.dmp

Download