d02bf16e3553b8faceea9365f2ab0dfa70536277e45e456f482b51e3f7baf855

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Size 1.3MB
Sample260427-mkbbjsby5r
SHA256 d02bf16e3553b8faceea9365f2ab0dfa70536277e45e456f482b51e3f7baf855
MD5 dc471d7fba40f040e622789343c981d9
SHA1 9519265c871174dfb2b26615a8aace2fc2a25f63
SHA512 cdebbe397cf81d0d63958d4daca49f9412ee38aa1af308b045113baa7862db496bdfd38d4c71291112f483f138f79cb0811c847f8133d704c7e82294e46d759a
SSDEEP 24576:WdGjxggCQFiP8aIGS85tDw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2Qx8fULNiXicJFFRGNzj3
TLSH
T105556B4266EB5124F4F76A38AAB575E01A3DBC226E35CADE13C0150F4B71A91ED32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5196	alg.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
748	fxssvc.exe
3404	elevation_service.exe
2200	elevation_service.exe
2432	maintenanceservice.exe
2464	msdtc.exe
656	OSE.EXE
3948	PerceptionSimulationService.exe
1576	perfhost.exe
2108	locator.exe
4592	SensorDataService.exe
4904	snmptrap.exe
4128	spectrum.exe
3632	ssh-agent.exe
5384	TieringEngineService.exe
5240	AgentService.exe
5416	vds.exe
5428	vssvc.exe
2420	wbengine.exe
5844	WmiApSrv.exe
4860	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3c50c80e89fac755.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009dd8a62233d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064018f2233d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef6af62133d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000638d5a2233d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004decb92233d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac17642233d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe
3840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
688	Process not Found
688	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeAuditPrivilege	748	fxssvc.exe
Token: SeRestorePrivilege	5384	TieringEngineService.exe
Token: SeManageVolumePrivilege	5384	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5240	AgentService.exe
Token: SeBackupPrivilege	2420	wbengine.exe
Token: SeRestorePrivilege	2420	wbengine.exe
Token: SeSecurityPrivilege	2420	wbengine.exe
Token: SeBackupPrivilege	5428	vssvc.exe
Token: SeRestorePrivilege	5428	vssvc.exe
Token: SeAuditPrivilege	5428	vssvc.exe
Token: 33	4860	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4860	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4860	SearchIndexer.exe
Token: SeDebugPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	1404	2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
Token: SeDebugPrivilege	3840	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 5988	4860	SearchIndexer.exe	105
PID 4860 wrote to memory of 5172	4860	SearchIndexer.exe	106
PID 4860 wrote to memory of 1140	4860	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_dc471d7fba40f040e622789343c981d9_amadey_elex_luca-stealer_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5196

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4664

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:656

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4592

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4128

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3632

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5844

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5988
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2796 2800 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5172
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2804 2828 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a45ef06e69237a2287bca8192daed576d364ecc00e644bd4f0c781e3719c0dcd
MD5 a449ffd1fdc0bc8cfe22281af128abf9
SHA1 e7d43b4d238d298a1a8f4703efac8dc9bc43fb72
SHA512 c768281497eafa89753663e1b38a9db22c8437f83381657aff9579a054c390db95d5654faa318ea2413efa5b31deeb5f40faa1518d8e7c4b36d3883a01bef1cf
SSDEEP 49152:kb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYLNiXicJFFRGNzj3:e3q6mjBL7wRGpj3
TLSH
T1C1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 035d5668dbf4fa9c6600bcd617b2df5f6fdd79ffbba33073fdc1428658caeac5
MD5 1f28a27ec989ab4513bcaf7dbb44941a
SHA1 774c56e4af9a05ae2f84a17574a81e90c47c4159
SHA512 d61c68652efee6399c822d12ba6a6b8865ae957a331fdba563b4772a809d8b1dd34ba098313107f2817b31b9d9022e38afa04cb164d33a95a17443c70022318b
SSDEEP 24576:hXYfDtczAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ktc6LNiXicJFFRGNzj3
TLSH
T11675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5ccc775a44dde95dea731f00d8737b8bacb9e33b0bf7792b48a9bbecab12791b
MD5 915cc048159fd43cb60c1691a2db6502
SHA1 ca8f0e6531c6944dbd5e04eb0f05edc5d7b01475
SHA512 bcf2fb1b4b0c34d493ab65a7f392634080a973e172916ecc72c544ba814e9532b7c9a13670908c1d2e444fe86eca8d545eafc65849bb3b1bb1544918b29f2ecf
SSDEEP 24576:I0Le5ji0hmxhrMA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IPji0AzdLNiXicJFFRGNzj3
TLSH
T191859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c1242b4f994dce786181966df1e3d8ae581d72cf3d00d3c41f70b4a0e07899eb
MD5 b5e101765aa136d14a83b9e0cc1c8f27
SHA1 7a5c75874ba73a85f1b2367eb9865400d2d63f48
SHA512 750c74f342b59a256ec1ce20cd1cf5157b5f0d2bea3b13f85981efd507c7cf021cda9ee4d7eb9d94c10b9a90f1ecce5ec4a403def01974f51071867ea84510af
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWj6q8wyuK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:y/ezSC6vUzPv+HjypLNiXicJFFRGNzj3
TLSH
T10E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d04da3944af1e1e6adea45339423502a62956dbabd56d59fa4222ee4e33ee20c
MD5 c176a61836e1cc7efb94f22686754847
SHA1 200a3ef8e10b4c1a92bac7c667ed5d5a8695c821
SHA512 55963b8bd7f691c3f1cd7626e36b8abcf522672899d64450f7157007b13c081590463c3d1fb910cd04b060c221c6d9ac7c11df50bbd4e2a1f59052cbce90d075
SSDEEP 24576:7VbqPb88hv/l+Bb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7VO88hXl+9LNiXicJFFRGNzj3
TLSH
T120559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 12ba528fc106aefc505ed24469548e5e1ac4989ac5cb63507bdb2ae47cc0dc0b
MD5 97d2514c1fcc72154f09543e0aa44ac2
SHA1 2e02e396173079720f889f3fc38de02c7900e921
SHA512 03e6f2d87468cbd435ab3966488b9fbbfe43c48383c06e2df83b90a7e95a830b5c2c98b24303703d35ac26e101a0f7d85f27d7c9345e03c821a473988914211f
SSDEEP 24576:DGU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RLNiXicJFFRGNzj3
TLSH
T13D5523D3468864B1FBFD003A867A5828B5845E2C9A595CE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ed00a14fbbf0b10ce818c0c5b81d2c1a81afdd4f62ed519547b84a8debdb72ad
MD5 b7051a6184e18b16b35912b9c2541dbf
SHA1 7b745302f2572cee811cb825a6ad69eee149910e
SHA512 d72323aeaf9ebaf6192c3bafa2cee255bda9dbbbc9e60dcf290dbecb3c6c62e1d3ccc29edbb21c6075bcdf745637f63d8ff2abd4a2276cf41efa8e2717f4b087
SSDEEP 24576:aJIUD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJIUDLNiXicJFFRGNzj3
TLSH
T11D75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9a662b8ff389c63be3f7538c5a15fde995e9324c2f6865d6725ecd5a3577ead9
MD5 8c6e6430b66e5d860db60c1bb1d9390c
SHA1 196371283c3c87c8f7f9f7cfd12b24d814e4d5c0
SHA512 1bf8e499d9e3f2a3562517d5b5f5449997f3cedeeb22cd02183f3219e684c315c017d50458e397c35f8f13277efc280e936d2cfcd2d43b5cec3b968d564c107c
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:tQvGAdlCEL8c/WRNw5Ca7wRGpj3
TLSH
T1E9266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d061ce23b9d432a4e50622dbf0b4f8798b715dffb6b13f24a401d245b813d724
MD5 0d90e2c412fced29e4c83a2e84bd8d7e
SHA1 bfbce626f4a9c6653adddbc223e6b6827b10242d
SHA512 2c2396a78a570a0b9452979eec028edaae52ae1189e691de342e3d9c85d61f5041488a700cf662dd67173f446e4d3f1d83d039d4a34e0ebcef3106235b639ddc
SSDEEP 24576:VfewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pljtLNiXicJFFRGNzj3
TLSH
T19875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 842110165a02e56f3c30497150acd3780040dde26ffb90ed39e98e0235a48d75
MD5 116a6a3f9d20cf21b2f4299a61f7e21a
SHA1 613d45e93e8ebc7a41dafa6b8ead622ef5203a26
SHA512 d04b344806b8063c7fd2e68f011dc712fa23dea9231564b924bac297a60db189c3e7f72f6e456b7187a7e24ac82fe5ede84997a9f60462a8f5f6f94c24defdcb
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZF9:JUEtQevvqc2W1cpV20I32/9
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8e00e279b30fa0f99cfb76367880d7a48209494c4de004a7e40a6ed3678534d9
MD5 1af25f6d0d0944b8e56c8827308a8b1a
SHA1 32b05aaf2c8d177fb7bb96d636038b37c40fbd91
SHA512 8b617f3d329be9c984802b9c4b0f0e92c0af8ad7d2e8e7958e4439964708e5b43d4d26af73079be0767b255004df709495a24dbc2533fc1da139b774bac051b2
SSDEEP 49152:2CbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:7oq2VjnmW7wRGpj3
TLSH
T1B1D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1fa719c158211253dfdc51b89ffd519434f10b0da15d66baa5e7784deaa32f23
MD5 22b48653df6663f04d36dd8aa74dc69e
SHA1 b391f616840aca20787501fa72c2b2e01bfc3ae9
SHA512 7d7f9520e49f88ae1a3b2a900c1c92b5d4acc931b79ef050cff41cd1611637f0894f6222f3718854f4176749cdf6d7560055ec53d1c6b574399128be59da949a
SSDEEP 24576:CAhGL6IFoiwtA5l7S532/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CAM5Foiq5mLNiXicJFFRGNzj3
TLSH
T102359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cc89013d9fdb1e628febca0ad47bdd46cf4da35ea6326f2c32da361a98b395b4
MD5 3b5737fd055015f9881b141ef1103496
SHA1 e3a1402aded90cea070ce4a4f4f12a0e04d9729e
SHA512 8c2a5784bd6d43ce71285ab438c72de790e8fc470907f7b0f1df58a4b07e528e5fc5f89723d0ac9d892d60e2b47089b15f48472ef6e5d22ef4b22378cf2ddacd
SSDEEP 24576:jwuROWJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jwSOSLNiXicJFFRGNzj3
TLSH
T1AB65F18632941CF9E9BA41398657C036F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9500b63fede8cd1e0f5be9a2ecc04efc6e363b869dae1f99df27554bf41cbe89
MD5 3a7cb43ec65379fed78fd2b9e35f02ce
SHA1 06c886b06f4105eb87a82ef6bd196a2a0e3296b1
SHA512 ae71ba9cfce0025d3525af9910d30a31e23bced124194f2fc6e558fbaca436cd39ef71d2040b64e508f16b9299d0c6ffebd84a371e82cba812c47266a63cc3ba
SSDEEP 24576:EZuo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mLNiXicJFFRGNzj3
TLSH
T18955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f05e988a45a17e744ad1b494bbd6497d0d9f0e7951100ed05499c79563a45ea
MD5 9def11ab79cca552d8add2e3f4deec63
SHA1 cdf563eced9fc3290b41ac6633215d993d797115
SHA512 bb8ce1ac92fc2a5992a85ad35d82cc63a14372f10bb1d87862631a743fd2f15990a4f922e246151f9b21a12185b6ac84c3560914b173829cd74fa39210560a3a
SSDEEP 98304:9QRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:0QyiKanX+PNDF9
TLSH
T11B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9035e968c8d03336c8c989292992474d23034b0bd4622ceabc9fdb3ab7b2df7b
MD5 42fffa695fdc191976c98f87c1d8f26c
SHA1 6c088fbd54839b18a5501229ff2182a25a471f6c
SHA512 157a48341163e60bdda53d32f1ed13918b35cb72970448e93e4f226f1d369d80baba3770a71b63a74a6395d0b4a0cf65b41f5a2cc94528a56497c8c7582d6da6
SSDEEP 98304:xQRQyi36YOcPDLvw2gAf+PN3v7wRGpj3:oQyiKanX+PNDF9
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5d164a82d89604b7ebe79fd7620f5ffe8b16ca95341ade18a39f1f08d6e30b53
MD5 e9117f42e33a900cf19a42ff9736bc0e
SHA1 a69286a21d03d86bba22db3c209badadebb105a0
SHA512 abebe1556cf71717f30d37fe7054241656ec5e77e7c6f1113ce3a22bcd29682d55acf890ee224d7021353b59345d32fbef6a71133419d4667fccc14d96c070dc
SSDEEP 49152:l68Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:zthTRc/d7wRGpj3
TLSH
T123B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cb388bcd69356d29b03aaede08f9574e3d2f45f0b374a6340eeed5bfdc941a8d
MD5 bd8bc929b5e6f43ee89cd12b1d47b185
SHA1 25cbe798e129063bc46de67fac25c61c3d32c858
SHA512 519cafc26939e2923acde31d802437ac99e6d243d5f911c3b936b66795f87c85cd10768dbedf81c803a08404658e8b0dc64890fdc56f9d26dec2d6125e05c50f
SSDEEP 98304:5y5112gYy5azzVvU69nLKnhZU7wRGpj3:ULIHRWhCF9
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 43fbe762035122d181b2ed1efc23a811a7e208871401771b7df71000fb355877
MD5 c6f981d849e51cacd92eea2dbf19d132
SHA1 f10a7302927bd93fbe32070c20746b30cdb173eb
SHA512 b532116c891bb9473addb5c6f5362b25c3e19e9d43f9cc1a7d534d72e08c3f836b44a86619891943be49503859eefde1f13c0acb20f76d35d76757ca1914a300
SSDEEP 49152:7B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glXLNiXicJFFRGNzj3:tu6JmIxd2dX7wRGpj3
TLSH
T1F6D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8df2086ee819cda8076d0e742ff25df38d98c93c77ac1b65a8c9bba0f635e65a
MD5 a650cbe314ad223b5bc648ebe805e9d7
SHA1 72907537a4a672428d0ae0c04cd239ae86c9cc5b
SHA512 a8fdab2840503cc3bc24f5fbfafe633c93d6500f389f155ef8986f596addfd8acbdb398e1601781f3c13b373bef4ca7da7b1e5d5ad3bfe157d3eb2fa78734653
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xjLNiXicJFFRGNzj3:gmifPqRW7wRGpj3
TLSH
T126B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9ae5273b0cb08f1c856a7b6e0bba1b1bcf72424a4e88779748094aa4e4236d01
MD5 f28f86ae2df52319a7363ba1a4f21854
SHA1 e70bfb66ca1e67578564a2a97450245c5618fa52
SHA512 b431d36fcab648bc3400395eec70a6fb6a26bc98a71681594d4ecb818e9fed1621ecc96853fa40a5647d2082847efd341c8620dd0891fcc013cfd37c210070a8
SSDEEP 49152:GSuZQIY0Be2KkRVtOnks6NMHqoLNiXicJFFRGNzj3:I5dKqi61o7wRGpj3
TLSH
T197C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 01b01ad8a3141de9844f83f485522c7d348d71079f2f9a95195092653723e81b
MD5 44bfcf1965609481c16ed730817b2412
SHA1 8543cca82deeaa142ea7f152efaa263e8565310e
SHA512 aa083beaf5d6ad014182b433299863f6eda7f3a561224a008d22c16a6bcd6a76b2b4f7cf06544c05b6720d21ac43c3bf1fb051a30afca125a245d7cfb1cdb8e3
SSDEEP 49152:fhtSn8EApI0figjgiDn0AP5wnLNiXicJFFRGNzj3:OX2iWphy7wRGpj3
TLSH
T11F95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 53f9fae9a5e231533f22a8337bb1cab8c074f54d71ae426407dbe480d9c1cc5b
MD5 bd5424d8dce97c12f8ae5716b614bb1a
SHA1 00be9ceb35fe867c7d6eb0c7e6bb6ae7f4e9ee6c
SHA512 a3a30b5528f49d3284b0b37ca89afacd547def93069ab9fe34308e761240a68486e17d04f06d73b3304335432f49428146829d596651eb7acd3f509ece0142b1
SSDEEP 12288:g6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e9d25dee691f56d0fe6ce279c2acd568d84b2f4e7dbdfeaa10fbe93ca051c5d3
MD5 7f8b24055aad848c25552ee48ba22837
SHA1 1af5bc42f41992216b574351470f44aefa21e1ac
SHA512 d010b3c7171c0ebc2121995357dc8f941df80709c8c2d7e21842973bbc225670dbf3f37724dd90d819f6639285cec3e77cf5a4d858cbec1b7c86fdd9bc95c2fc
SSDEEP 12288:odiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1325523D3548955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ec6e8ab5ac8a580f9cb0b10a34d17bd88c813bb00b83287499408b252ba7cf82
MD5 186919322ced8e38385252d3108171f9
SHA1 e1e15208f5efe405731dc433fec25b0e9b49c3b3
SHA512 d2d9fe20191c7c225e7d471d2c18977fbdc98c6f6dc1fe657ffc830a902171503983f0054de3906f22c63881a275e03cbd3f92adb117e6527ea3e3a46c9785f0
SSDEEP 12288:E/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:EL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B65523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6edd04de23045312c68e2273c63a5c036def8011243d3e919967e21a2e7a2353
MD5 9129d8ad4a1d764c6ebbfe6a63dc41f0
SHA1 14799def7ff1365de9981e5c34ecc43a3c784361
SHA512 2e7035c74fef3fd605227c6fd03381f7e281330e6c6e69626e6e7812e2c5db539681cb07aedaacdcf568d33fd49687c06a280b005c1451b2b92b609310e90c92
SSDEEP 12288:5VsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T129552392168900F1E9FD803DC6764424F2A47D6CD7325AEBD3003D1E5A75FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a9307a18fb852167becb2aedeb67f2e016de9f86e47ec91b88125b552fd384da
MD5 a07aec1f2a5e0a9a9d4246cbba58e81d
SHA1 8823db4f760e85d3ec351357e3d8f8804afdc4ab
SHA512 ccd076fcf0c38da66079620f4fe2ad01df3ad8bb1099edd00cf26851f3f9614a619af41aa8983f773e0629e270dff14a4833440f3c30603e96039aab69420c6a
SSDEEP 12288:fEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9bb327b2b62dd152bbf2e967018d257c3f35d417a888c76efc2065c35c366866
MD5 b7b9ee51ad326d7e483729fb67cac10a
SHA1 a6c9b4e588acc9bb23d39110b6a60332d5d44b5b
SHA512 5fd8fe25788592ca8192b619443fae3ee52af8aba3cec68a5efebe10ba6c12de8bc40d65c75c7a9316ff340158d6085a69fb9ecb389d30abb77952e03655fd49
SSDEEP 12288:ApiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 84f59b1d49e0ed10cd1aae5dbc312c4ccd7bc110c3366e31c1d2bb075045772b
MD5 364c77b6aa72414066dadf773a769b86
SHA1 8b87f27edefa7295dddad52c54c12f290752306f
SHA512 e3ceea849d16b59b14e3f4dcb3dff14cf37a6ff100c610ca79adf3aca48edfb37c12f2e9c468bdc4d885eef20f734c4b376ac64a9ad5e16a4f93e53075627ff7
SSDEEP 12288:jViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:j5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1FAFC003986354428F5882E2DEB5659E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 587063b24fdd0a9d0204410c46213f0f64b8867a80a41b1543a70c5d71b03838
MD5 c6ca522cb9c369095d58a41b650ddae8
SHA1 e654d19a74eb1076f7cc6da5e971710a00f119de
SHA512 b09278322e98c7cdd1aed4108dad3b3e70119e2bae99c8253401b1b9cd4afe85bfd48eeb959efee065f8693977df7dcc0a78133eb64c25036089518363ff8e37
SSDEEP 24576:NZM3zFVSOh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NZM3zfFLNiXicJFFRGNzj3
TLSH
T165750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f5d73d3d9b10d1780508d8fb9ec98dc02a9d0913639caa29f07fba6ac5be49e6
MD5 a34cf54ec620c7e939d2e62ab9d2deb3
SHA1 8fc50184541636764a4d19e83f48984560243649
SHA512 740349db95caa933abf7160183016f1185991f138b7dea1926f52c914b1d1f8353e4e9c57b3b8285d2edae85644319edced804bae364cfa6732c864c0c226de2
SSDEEP 12288:tOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:t4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C35523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 25afa66e39ca1ac9597bf31ffd3e25a6a96fb0664398031cf89d34252e07aa8c
MD5 64aab2d0a8b8d0d943f4009572b6dfc9
SHA1 c304526edbee3cdcd2b2c35921c24ca843fe701c
SHA512 6030f94f8ad0c1fd92ac91ac9ba94377b93c7987aa60a46f08193777dde8050a104f950f1f0b18a4447a8cc679b4a91769c456dd393162158bda50e2bbb0a498
SSDEEP 12288:NiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 72bdc0debb29de95e3495ba7dc6ce8dfe694efdd39ee0b7f87370a6b7b5df742
MD5 bdd00db1eb65084a8550567abd105fa8
SHA1 7cb18b422faa904ed3c2f6ed8d0339d01e50c359
SHA512 4017ea130f2e928ed30287a4fb582113b63b7550dcb161c5b66ccaba741967eec6a4c4d9eb1775244bf44cbeb74aba1574d2211213eab84f30879dce1aa3dddb
SSDEEP 24576:Azy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AyLNiXicJFFRGNzj3
TLSH
T1EC650247729530F9E17A8139C9620911F3717C3647208AEF53642A7A6F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ef55b7ca9f0d04e50ccc2610fd782c58365b076234e695a70a744c59fe225e09
MD5 95a377f97c2e92db70cfe65873b50dc0
SHA1 3c3e6ead093c3ce4b6d5fc0ebdb85e5d54fa6d79
SHA512 1592623a2fe9293b0b0ab0ca7ee9612880b10a30175268f9c771d137dd26050c5967f7c77d1708622333e490108a7a8d234bf4cedc5b2fb64ec20b4b7c7725fc
SSDEEP 12288:XOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:X4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A75523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 174d3bcbe475addfbf842d9c2828bd30c5d7c0b483f43288b10158ac97a05fa0
MD5 29198b564e95b1cdb226ea0881c13bb9
SHA1 a753cfad301f5d8f48faa1050f5cd282d82bba49
SHA512 d9ddb0595360b30b7e314c5650390dff6a4e238dc6af06c17fc142d200dd3753710d371b5b4451d05e28c0a2b9b0efb1c737ce1af904bc97e9e242c7f33f5107
SSDEEP 12288:wOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D3548955B1FAFC003DC6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8cdd8d9fa3eba925a3503dd4b7070d61b4841c933a6fb5d1e29e0626f410d26d
MD5 668c62728e27d60483e222e6dff1d9d8
SHA1 e9cc5e6e3069546655b138c8e204d5cca6b06ba8
SHA512 2fce88b172f8f8f947fb57b07b99fcf981498ad0f6a6a28cd9d5695083f94c9e645a94b65d8f8b97dff3971ffc12be5dbd2ecc4296eac4581be93372e0470f96
SSDEEP 24576:aCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAf/TwSfVcYG3K/cJHlnFR+IGe:aCUAPTY+8Wg2lIL8lrIUJLWwOLNiXico
TLSH
T11165BE1EA3DC0896D4BB81358A518A16FB723C2E1B2296CF1160C73D6F27ED95E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bf8617bd2f2aa9a5ebbe15e98abebdfd64b732c47836c0520897b806023b5eea
MD5 7957ecb282cedfabfb2e3dafd6c716ec
SHA1 592bc4988d33183e737b1dc3416a36239a9b86df
SHA512 839943f7fb1110ce762f1b4e4cecab7e5833bdca347554a032b7e4af98857769a982256114de01722ba83bb286ca0cd88e80a79c1cebb6af5b05ee8499f229c3
SSDEEP 12288:WpsfeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2b00a94f6a182d90b24ff9c158145074214a4323e53061d8e27f55153b517115
MD5 7527444ca9112eb649039a566b53f500
SHA1 83d4d5c27a068e92d5715b69c8030f283cd87706
SHA512 76145ef6e23dd61aba50cceaf5828f1e34a510417bd4d719456d071a90ab3fec9d5f43f89306311e2d871bc552a44a8e0d0e6db6b09d27e52ec422ec563fa1a4
SSDEEP 12288:UfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ur/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T100552392428C59B1FAFD1039857A9438B54C7E2C9F1598D3E2043A5EA238FDBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5cce87ffc4f670e31a6b85e9f9b42fe07a4aa318ea6512b914daf187ef2bbb2d
MD5 6181a00cffa9a989d516a9d80ea478f9
SHA1 64beccca840a763d25ea8e0ad4cc941cfc2b1856
SHA512 e6f7fcd7457a118ce687d56335ace027e080338a5528903ef750baabb53aa933581e9ba0ac11bd1b2ab16255d5beee0c245a5ec79646dec39a717546420edeec
SSDEEP 49152:lRZwQCyiHiQEaaPnMgLNiXicJFFRGNzj3:X9xvPx7wRGpj3
TLSH
T1CB85B01E62DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 9f0d1828389702ea4d7717a4e7e42a59a6b87efaa9ce3716887caa38b1ad5b36
MD5 af984f4568323123fffcdbe8d18e642d
SHA1 4836eda456153e30283e06d85cfd6c2c62943c30
SHA512 d70895c7a86ae63706c0ac93c7d9239971ec6b1c0d9fc46ef7ef63e93720e3ad79734679e5cc79bb3fd4bdb6b6ec9970dff666f4c82641777b3e480727e281bc
SSDEEP 24576:QbxA1UG7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QbxA1UcLNiXicJFFRGNzj3
TLSH
T1C055126E129C14F0F5B9903D89A68005E3317C2A572197EF6180923E4F3BFE99E39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ed6a32e966a7bca9743a804262135e2c3783c8eea70f6258c5dba6e36b7e8104
MD5 6e6f183b4391e6b6bfea317a9c9148cc
SHA1 084d3eb3e1fad121e1fd655f0631379dd716ec89
SHA512 5f7fe876debf2ad7c37a9477d7ed62197de0ffac8b59c0d9a87d9f016faaddfe2fc6adae9f8e6ffd4c5a4c2fdc65f1494e4147e8e483c6fff5abe157cf085573
SSDEEP 24576:8jsmP0yHaqrVqHra44KDzMsrnm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8jRP0yHfVqzlAsrnmLNiXicJFFRGNzj3
TLSH
T13C45AF2EF2B910B9D4AAD136454107B5FB71782D1F209AC70170C635AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 790d2e4fe8867a89213042d5e8266e240ec3d6ed0d8fb7130e0b78d1341e2094
MD5 7a0cf837e8ea24c4d4c27dca357aff35
SHA1 d158c04ad8eb5f72aceeaffac3b1bae6a3e37380
SHA512 107476a169d0be3e1ec3cc098dde2527b675e13cdc60e83d5409dc4da3d00f006e469fd86fc7463d578ca055f5ee03987682b2a92f312b2ab517d184270c7352
SSDEEP 12288:LJiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1725523D2518959B1FAFD003D86794428B5486F2C9B2619E3E1543E1EA27CFEFCF38162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6d51c79992082765818e7fe1dda826422d746d53e99116d4ba5288487327e6eb
MD5 fc8cbcb68a4a4bfd7bb27ab8a3c19be1
SHA1 4ccc5a34e08ae6a24805b49251b6f7a6691d6452
SHA512 e612a487777cd0839834592d67e1871619114ecee463852c123d9694830585e1824b18a9de134821533de6ae7778bd5fb7819e315ade114e83cc556131e49326
SSDEEP 24576:KALBUTn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KALBUDLNiXicJFFRGNzj3
TLSH
T163750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b311f28ea2d281e46f5177232143638782565f1f23682c2c60b98bebfc6d805a
MD5 1e63f09a95ad4aaa7b836fe222956612
SHA1 87b424d13a9cb52354843486afe8c7b179e8078b
SHA512 90b5d8e1d8e91cc37c6b4064fbaf03d1e4e8a7b04192e9cae0b7b2db93404b018b8832901bec3316978f3a956f1cb61368bb884eb9e622eea283448fe66e5b86
SSDEEP 24576:AfYNHC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AfYtCLNiXicJFFRGNzj3
TLSH
T1F465F12F62AD18E4E57B913DCA828109F2727C66171196DF01A0827E1F27FE9BD3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6fb580806f5bebd38e39b960a4945344c111ba8cc7d1283bbf9597c70c793b8b
MD5 ed3fcfca93e212d030802d880178a3ba
SHA1 6a9854097cc3cc9970b7edbccd8ec00188af0447
SHA512 6927cf28797e8f3a7d452f50f5e44e66e767b643218cb0433136704d2c041942630639e1ddfa5157064d7931b616cce386f3332de0026a5f4881ce38e7e62e08
SSDEEP 24576:3nXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKC:3nXoJJYH84VVS6AmETJas+cHBjSSKHP5
TLSH
T1F465BFAEA2BC04E8D5BBD17DC5C24506F5B178651331C6CF026082BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f41c48efe0cdbb18d5718a38005db2efac9abf3c1077db8d96ebbb921cd02112
MD5 b2b50bf7af84df4677c7491dfda8470f
SHA1 8875aea6a14989a1e9c90f36ab6bd5107e6a8f57
SHA512 037601cd2bd62a8b48167f14bc41fde258ff2fda3c9303554f04f78255e1931addb9f267ee05f2953435e5e9b0657b6c48951256eed68120fbaf5d462900717d
SSDEEP 49152:DDLL9TuJ0M/TYW2P1LNiXicJFFRGNzj3:A67wRGpj3
TLSH
T163858D5EA2EC42D4E4BBD6BD85B79046FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 da5e080e611db99769f4f8bc699ea6cab55e2df0eec8722de963bf04cc775852
MD5 3591c1726470ec625b2114028ab4e255
SHA1 9781a6fb1bfd19945b80f3053311dcf058b037d8
SHA512 f8f0bff71775d63a26602905c4a086c40a9c78ea2a795f6b109b3347bd9d09e23854315f488c231f3e99aad75ac946d00b4b94a54e538698d06fec5e0c0e36d4
SSDEEP 24576:UegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wn/TwSfVcYG3K/cJHlnFR+IGNe8j3w:UngOJOmPOHknLNiXicJFFRGNzj3
TLSH
T13555CF3FA7BC15D5E07EC13D8A968816F6B1782603255ACF0160827E5F2BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 bef03ab625b05be7690c09f908b670a321e383ad0f694fbf9191c61d6333c944
MD5 1cea55412de548b26544492eddaaeb26
SHA1 4d04d6d5b1ec0fec0dfdb2107b9f17f960d8b2db
SHA512 b991c6ab7d892b079ee584d53168d8bf6387acd0bc32600a808975276a9d31208d4bdffe98c9f2c77a9786e1eb700eb9bfcbec71ac3ce01385b504b8931b7ae5
SSDEEP 24576:ALJnJiTk3R3waE4JrO1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALJnJK8R304lWLNiXicJFFRGNzj3
TLSH
T1F675E03DD2A810E8E4B7C2B4825A1656FF31387C2B2169CB55B4D5353F12FE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 80cce26154fbe2f9317a2927c1f4e7e42480818113421c2fe979c54c1654db07
MD5 1fb9aaa3f68acc5311703d05c3455bff
SHA1 80ec8c7223696382d36ced4f383d6999f8004ac4
SHA512 c3d6ad1a961e12266a4d27567010bd9275e279cb7155feb0058efc9bee560bc05f4833695c1f393e7fbbd05ab0bb030b96ac2c3d721e0267b7f2595ec5f5c064
SSDEEP 49152:h9GqCzDScAZmlvTcFg8Ph65LNiXicJFFRGNzj3:9i7wRGpj3
TLSH
T18C955D05F7EB5298E8B3C9F1C96294159B327C509B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 02dc5fb7666f120f48c4f0cd6176b7f2e051d95f33cebaa3774b006bf343d13d
MD5 6340bf28500e97d2dfd2a292a6c11538
SHA1 838434bc470bcd831176047748b1b2c23db273fe
SHA512 2f6507315faf030106e18c106cc9113b9709f777f8ffb2692cad041704b469bec8ed76a80d3900994d094951e7f47391832e265867b8355d578e564e60de3502
SSDEEP 24576:MlYJeXm5jUuE3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MlYJeXmRUuE3LNiXicJFFRGNzj3
TLSH
T1ED55129E268C30F1E27E403D85A24414E371B879571217FF91A0A57E8F7AFE65F38A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 0ce177a63f8a002968fde72517d117f9be07cb159bc590a69a05780886e8a77b
MD5 6dd116e4b9ae599a06ab3e36af1cf6f5
SHA1 7e1a34b13e1e9118998b7c3b3c8ddb845c0b8e6a
SHA512 654fb299f95adbdc54c58fd0733e3e68144748de6cd774bbb0bb235c8bcb931bd0ebe3708b61f3459f26e82779cd8dabe3ffe4e3babcac1702f6d39c942be0c1
SSDEEP 24576:LVtyG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVtxLNiXicJFFRGNzj3
TLSH
T15C65124522C465E4EABD013CCA734064EA647C249F2157EF9190BA3F6B36FD5AE34B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 cb59cc3215a8c59b2c64dfdef03be0b4fd9b5cf6c860ba8185fe6dba07d961ab
MD5 eef43784b64e06c34a837a6ffecee82f
SHA1 6bfedbb838ad27b5c42481cdbfb1cde6ef9cb664
SHA512 1e389d59185371faeebaf239be33ce170263975d07aedea38c4919980a804db54000fa6dd28e69839eaf02ea98b6dbaf7eb21869abc376d3d35e488b32f2df16
SSDEEP 12288:jPTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523DA118965B1EABD003D86364424F1887E3C9B2528F7A194793ED379FDBCF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 a7e99971e026fd0168385d0b36a74b71a448932ef4ef4b06385d2de3fc707b9b
MD5 db23910a8e5efcb37319eb83783ddbe2
SHA1 1f6eea30793892598a26083b8578d90934e4cbe9
SHA512 7fd2d56c7357ab458b6d73db0c81a7e318cecb373c7f0c2ce1e81dc95d65a30b8212756b4c3dabbd1d3a0a3335249fdbf5a3bbc4d0999a591a18ec246abc2ccc
SSDEEP 24576:xC+TyQIu93VAumZr7jmI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x/TfIq+YILNiXicJFFRGNzj3
TLSH
T1B9558C1DA7E919CAE2B6C575C8A34493E633B872137186CF2044C07D499EFE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 d0b4408aee0d9bd3897d810cc08f9e616dc79afac9e3fe251e1dc5b388a6b7fb
MD5 b5a06307ef4f9f6136848e0ef300d653
SHA1 3cca56b0acacc12c14c7542841b2a15eb4619676
SHA512 420fc2286ffd9cada3d1ae5d479bd3710957a9d25af203c3976cd0ad185a697cb38743faab25bc400ee6079e1aa9b8d3e0d93f633711484356bd45d11948ca29
SSDEEP 24576:KLQikZz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gQiktLNiXicJFFRGNzj3
TLSH
T1B665F10FB3AA00A5E1BB813C88554115F6B37834571267DF4290CB7E4B77AEABE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2b93a0238e62c33074e24545385c3c5edfd54b84f7dbbd6ac6ea99504ad7bb0b
MD5 7b519fe9785640c68ad5d4f46d1e8416
SHA1 1ab49438d22425b708997d8020abe928d9cf73ef
SHA512 8fcff2f38e9d79f6a4611e7eddf45eb338786db66128875dbde4310cb103fb5c2adbfb7bfeb782d8b61bd44d768d01a6bb44bcd8229ceb5cf032016564ce60f0
SSDEEP 49152:RpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPGLNiXicJFc:ipC7b4+80GTkR7wRGpj3
TLSH
T18CA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cad390ffafc256e9cb2be550898121c7c84613a8c9292044bc4bd362f563e452
MD5 8129270b2e1f41825ec39f7f18f4b577
SHA1 718d286f00fc92154c25da48bfcb143776115d45
SHA512 2f5ed34c6c57bff692afdf55b3bb10c5113f972602d041f3bb6bfbb3d3ea42a9d5f14435dce868180a6d4defd0a66c2b49050df47c802551acb310cf4657a430
SSDEEP 24576:dSAwJPE1IDAo+4Kt+l4413lUQu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dqPCIo4Kol4jQuLNiXicJFFRGNzj3
TLSH
T1D255B02AA7F956F4E17AC774C663C511FB723822133163CF9290953E0E16AE89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 78dc34ea6ec091d6f84e5771d6b4b8bd5977161f96c33fd6a49f152810451ee6
MD5 404dd9f95318f6b48ce395876b6c4352
SHA1 f989bb830fec88884768e232cf1abb94cdf926c6
SHA512 c097f998486d672d5688a5b7d9f4102a320ce275b0db8981c01e63aa3a136523e197bfbd188fcdaceff920e089d4644104d09887cd3129f5fedf1ad734406d17
SSDEEP 24576:XyLXPLcT94t+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Xy7Poqt+LNiXicJFFRGNzj3
TLSH
T1FF75D03ED66D04F4E57AC13CC6A38906F6723CAD033166CB15A0957A1F6BFE4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 d8067b2dbd1c156ac27d8157b12f92dd48b21bf9b3790b5b65c92535d69080b1
MD5 f58918df557112661805c047df370b6f
SHA1 836063490446ef267e9a1f2a714cb595218a7135
SHA512 b98c4ba394b0685d930064688a4a323c296c69885dc4278d988cbce043e7a5d59bd26d2ae86d84d58e2d4bc8cac82e1afa7f6c92547b838f136dd006607f39d3
SSDEEP 24576:cWv8qjpj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cWv82LNiXicJFFRGNzj3
TLSH
T17D65129E12C424E4F5BD4138C636802490B1BD3A176559FFB1C4A97E8739BD6CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/656-160-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/656-74-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/656-80-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/656-84-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/748-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/748-51-0x00000000011B0000-0x000000000129A000-memory.dmp

Download

memory/748-52-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1404-83-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1404-1-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/1404-6-0x00000000024B0000-0x0000000002516000-memory.dmp

Download

memory/1404-0-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/1576-105-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/1576-169-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1576-100-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/1576-109-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2108-180-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2108-112-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/2200-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2200-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2200-42-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2200-373-0x0000000000DE0000-0x0000000000E8E000-memory.dmp

Download

memory/2200-147-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2420-378-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2420-165-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2432-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2432-61-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2432-68-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2432-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2432-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2464-70-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2464-156-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2464-376-0x00000000006D0000-0x000000000077E000-memory.dmp

Download

memory/3404-142-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3404-38-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3404-31-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3404-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3632-140-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3632-144-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3632-134-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3840-15-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3840-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3840-24-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3840-370-0x0000000000BE0000-0x0000000000C8E000-memory.dmp

Download

memory/3948-98-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3948-95-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3948-89-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3948-164-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4128-119-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4128-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4128-377-0x0000000000C70000-0x0000000000D1E000-memory.dmp

Download

memory/4128-125-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4128-230-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4592-375-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4592-127-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4592-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4664-372-0x00000184274B0000-0x000001842755E000-memory.dmp

Download

memory/4860-178-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4860-191-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4860-223-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4860-207-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4860-172-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4860-382-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4860-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4904-129-0x0000000140000000-0x00000001401EF000-memory.dmp

Download

memory/5172-414-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-401-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-420-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-419-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-418-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-417-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-416-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-415-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-422-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-412-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-390-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-413-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-411-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-391-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-392-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-408-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-410-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-409-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-396-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-397-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-398-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-399-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-400-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-421-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-395-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-402-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-394-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-393-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-405-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-404-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5172-403-0x00000239C63D0000-0x00000239C63E0000-memory.dmp

Download

memory/5196-108-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5196-13-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5240-150-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5240-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5384-148-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5384-369-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/5416-157-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5416-379-0x0000000000660000-0x000000000070E000-memory.dmp

Download

memory/5416-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5428-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5428-380-0x0000000000F50000-0x0000000000FFE000-memory.dmp

Download

memory/5428-161-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/5844-381-0x0000000140000000-0x0000000140219000-memory.dmp

Download

memory/5844-170-0x0000000140000000-0x0000000140219000-memory.dmp

Download