01902cf1b0bfcb444892ba1758c2e90ed18e7d657585da33f1aaff17330b6e68

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Size 3.2MB
Sample260503-krshases5x
SHA256 01902cf1b0bfcb444892ba1758c2e90ed18e7d657585da33f1aaff17330b6e68
MD5 eae063c8664fc63da9179db471eb5549
SHA1 fef342cb9c03b8e590e823094143924fee2041a7
SHA512 3434cc531d82d7965401850919d2920afa8d522684677489b383bdf8368aee67d9ccf6a694cacbe2b1341a95f2b331b2770c87ad394afa1df1f36fcb7fcc9bb4
SSDEEP 98304:Hn6r6+0FUFIIsTY9Fl/7boUi+XwZPwMQBW/KMZKWKKFTkFdRMkVTKAZGToClTjgB:Hzcl/i+uPwMQB6oV
TLSH
T1CDF5AF227761C476D1732530966AE378E1E9BD310D39423B62917F3D7EB0A42E538A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1728	alg.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
5004	fxssvc.exe
3944	elevation_service.exe
3432	maintenanceservice.exe
4660	OSE.EXE
4044	msdtc.exe
3524	PerceptionSimulationService.exe
3208	perfhost.exe
1840	locator.exe
3940	SensorDataService.exe
1908	snmptrap.exe
2400	spectrum.exe
3360	ssh-agent.exe
1764	TieringEngineService.exe
456	AgentService.exe
3284	vds.exe
644	vssvc.exe
3176	wbengine.exe
4924	WmiApSrv.exe
1160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f55d354c8368bef.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_96484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
464	2512	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb9ab320dadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9efcc21dadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8399220dadadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007adcb921dadadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c201a21dadadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009603f22dadadc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3136	DiagnosticsHub.StandardCollector.Service.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
3136	DiagnosticsHub.StandardCollector.Service.exe
3944	elevation_service.exe
3944	elevation_service.exe
3944	elevation_service.exe
3944	elevation_service.exe
3944	elevation_service.exe
3944	elevation_service.exe
3944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2512	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Token: SeAuditPrivilege	5004	fxssvc.exe
Token: SeDebugPrivilege	3136	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3944	elevation_service.exe
Token: SeRestorePrivilege	1764	TieringEngineService.exe
Token: SeManageVolumePrivilege	1764	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	456	AgentService.exe
Token: SeBackupPrivilege	644	vssvc.exe
Token: SeRestorePrivilege	644	vssvc.exe
Token: SeAuditPrivilege	644	vssvc.exe
Token: SeBackupPrivilege	3176	wbengine.exe
Token: SeRestorePrivilege	3176	wbengine.exe
Token: SeSecurityPrivilege	3176	wbengine.exe
Token: 33	1160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeDebugPrivilege	3944	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2512	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1684	1160	SearchIndexer.exe	120
PID 1160 wrote to memory of 1716	1160	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 884
  2⤵
  - Program crash
  PID:464

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2512 -ip 2512
1⤵
PID:824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3276

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4660

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4044

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1840

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3940

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1908

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2400

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:208

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3284

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1684
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0bf5b3aa585adbf333c2d386f65bd95e71f40565c4ab19d0b6e7c4257aa10105
MD5 8eb8db44d322887de316a7921debbd9e
SHA1 72887a8f161292272233812e1981873b2a28b628
SHA512 95694406a63c761517f762029948714caaf996bf2a3bfe7e7ccce96decb9d8cc101c1856cfceb3fcf67d10575576e030b6aa15ab9d1cb43093e0b1a0f74d8a51
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnsSvrJ2RIg5uNA:03q6sjBSTjgiA
TLSH
T1CCD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 1f6aaba143663364ff5de39a1237a7708b27ce3f3c4eda045a8ac543e0241f84
MD5 cd7a5f8fc248cbba2122cfc67326f7f7
SHA1 4830ff2b2538ea6f4d8dee7422016dad0d76ebe9
SHA512 f6eab52d1b4539c95644c4fa712cea8d201275ce4a77b6ec765a930a9475943ea408879d32a5716099c05c7d85a9a1cf4ae2406e1cd3f7cee1e98f8124c82350
SSDEEP 24576:VXYfDtczAjkzhvrJ2RRaPYHZ1INzRDWF:AtcWSvrJ2RIg5uNA
TLSH
T173050128B3E508F9ED67823DC9A28511E77378914760E78B03E4D9662F632D85E3EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 efb9fd05dc57daec6ec3bfd1afa2df693d5bc8fefc7fa8bf75eed9e92cd06008
MD5 645302babb82655a83e17c95de2e58e5
SHA1 934b503726cc506e4a96357d7d570281da7969f4
SHA512 57329ea8230a10ff27b3ca9b53113d5c94ec604230f80a4279e0a98bbc2dadd7a3f6107d8585b80007eab254022e7f1a7e504f5361cc886586a85d7088fca1f4
SSDEEP 24576:s0Le5ji0hmxxrM0kzhvrJ2RRaPYHZ1INzRDWF:sPji0AjhSvrJ2RIg5uNA
TLSH
T1F135AE16F6748371D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7dfa65c34e220db6b44d2a17cbd98af43bb4c26578c606e32d3acaab0a2393b5
MD5 c967979d3a35437f06857af1dc58ce1f
SHA1 399a22df7fa3af00249a3b935dd1dfb925a4096b
SHA512 e489323b6b33033d0658e1586cb51c16e08aff46ff44c14e19ee5ce3bbb2a466c62d7c5c1c356e1fb7b778bd4d946e93e0c4cbd6dd6214b7a7dd0a8e436bfeaf
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuGkzhvrJ2RRaPYHZ1INzRDWF:+/ezSC6vUzPveHjytSvrJ2RIg5uNA
TLSH
T1C3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6fac0fa53ef684f3b309cbd60fb624dab42dfbc73fd483ac64b129e3d142c681
MD5 6b52c826adbb4bb74b9fb2aa58ab0491
SHA1 551e661d266c4385bd8d92be483025a3442a32de
SHA512 dbcb168b3838431a4c3bfce2433750843901be1547d1219fa25fafc1ceaa0a84f0623eac47788eb12780c8705592bc794f4a49cd2c10836c3697128f46f22391
SSDEEP 24576:gVbqPb88hv/l+YXkzhvrJ2RRaPYHZ1INzRDWF:gVO88hXl++SvrJ2RIg5uNA
TLSH
T10A559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4c2e448bc9cfddad3f12a666834b5c034303bead623ca1f81a3a45b6b0e3c069
MD5 366012d1c1e1a86f12a0eda9f429d49e
SHA1 724a88024c3060abd7b825616d4f2533b483772a
SHA512 05680de5e540d6a40be66e869440aeb2ac696e66801099844f8879da22dd09b02231c7061ef92b560602cc7b47b572ab71b1a63c125780f0a4fe7e36b9467168
SSDEEP 12288:EL4kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:EL4kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T14BC42341D67A54D5FB590B3632481CD2A3E67CD1CC29B70B91A0FCE376FD491EA2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 39afcc8ba102dfa36143d7a2ad3e0c97e6ff451d238467e75522b14dee0b6eba
MD5 d57185f069a813234eb4778ae6e2a7a7
SHA1 d62c127389c295f98f09adb07703c8b595a224b9
SHA512 4d7a73904eb156916290ac605b83694e7d29187e67ab5f7d0bdeaa0770a2fd45592faf80635a44e2337d39a00018fc1768f2485c5e0dd77646ccd3f6b1fddc44
SSDEEP 12288:/eBNUbTVO86UfkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:/JIUfkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T19605CF2BEE38FCD2C27A4D7956918640E7B278704F22A3CBD164C24EDE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ce8c7bb28464c5e354b231819bdb9c8bdddf033264e1d41db869af399e468dca
MD5 7929379f6750f18a1cd6534aa6af2fbe
SHA1 527fc01420dd738b7430fa348e1ece334e0ece8a
SHA512 154d1509be5a197cb63cd2647e440eb2e13ee2ec00d190b94f10b395bc6119245b5a38c908d55b60e724cd9de6ece0a55f511c6b158a42f8e5c1d205f79e7f5c
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THt:YQvGAdlCEL8c/DRNw5C7TjgiA
TLSH
T18A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 359de3f56839357e378cc46db2b3e8cb0afe48b71a897121f9c0edd9a0a3c15e
MD5 daf4111643f12d4d04609cb46f0ec0ad
SHA1 2a46b6191aeed0e0738bada09285d1d833ab75ab
SHA512 aafb8af3f2390a42dd4f7c6065a3953f86cd093ac04757a0e68b72804df35bdef9cabbcacec402b58d9ad3227f16982c0fbef7d811ab4705e1ea9b1b014cfb90
SSDEEP 12288:zAwSfxL/2Dc3RDLLmt0LDQewsAjRkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241Dx:s0ewsAjRkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1F515E031FE74E036C3BB0DB22B26C716146D79604F612AC3E3A88E9E59741D22776E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8cfeb22003e18055b574de4a9e7afe161b3d87f733aa9605750be781d1806630
MD5 b0fe40fdc27ad0c7f99d93a3023a4e87
SHA1 043a380e2796bc76b0562c1d488f025308eba5b4
SHA512 f12b9cf95eb64e0a4f089fae02a2f7c92909c7c6b26c196e421b0d46dcd32d2d3cf2b5b65b9c8d55cb39f33fed18beec2ac05b1110b062f80f8ea4e3b9186d64
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9:IUEtQevvqc2W1cpV2tI329
TLSH
T1AA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11d05def556df228c6737e544c14a7f6407875f2505927c517c85b8ef141ff89
MD5 210fd697ef9bb35640e75699c03e5bbb
SHA1 a35fe98b3c067d9a58ea07195f601199af112cb7
SHA512 810795b8bf178f7073ff678d1081ec768559f1c1332c9f317b44a32f24534612a7f92e9aebde6e43179992600d989f5d3dc9f88900f285ba85c731380e6b15da
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zxSvrJ2RIg5uNA:RoqtVjnmfTjgiA
TLSH
T17BD58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2a5cebcaccc95abb2e988f59800ac83ccf3bf5284540efac546d2570bf59cb13
MD5 4f06aebce80baa32fcc7c90e1520e694
SHA1 ba7f3756d10d63d68be69eb5552464d12ac6fd9e
SHA512 337da53f569360d7621385c73ca35804f75473581f9c331df0f39bd25faeadb8df93610a0f5203537573ccd2d997adde98076f785e14eb9322a88ef7791895f3
SSDEEP 24576:jAhGL3IFoiwtA5l7S53ikzhvrJ2RRaPYHZ1INzRDWF:jAMUFoiq5ySvrJ2RIg5uNA
TLSH
T17535AD80E7F955D4F5B3AA7899B68171EAB6BCA65E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9807dcba3b2b1cde1a942d34e91687ce8448ebcdf8b200f9ad6c44300781840e
MD5 613cf35496ef1bbf43a4c6e0182cda44
SHA1 bf21aaa1932ee67e49eb24ccd2beff7ca4a65d16
SHA512 8829e28b6827d8598d6eb92d2adcc318c6b2b2eee60137592a503d13030264fbbbd66b508eb83a43a9d1a82249514ebac4d4259c5039e382f4bf0b1fa72ce092
SSDEEP 12288:Emw5HEjsChNVBFgl0WDm+CmkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpC:hwu4OWNkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T16905F14677A50CF9E96782398647C532F7F2BC422A21D71F0360C65B6F77261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f606b4c4045298f6128475b87d8f9f3f5ef3552c65fcbccaea294f244881cc5b
MD5 83f13c0819b38a6af02142a76ab98a04
SHA1 eafe5a02bc0000e257d05adf4b8bba5bf6fbeb74
SHA512 3cd9eb1eed93bc69be98a84912412868e55ef745fe69e5c19d027aa48fed9010f8b4a74721308e3493cda3187739f0bb297434c5407703e82058ec0f9837914a
SSDEEP 12288:EeZ1IyBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:9ZuckzhvrJ2RRaPYHZ1INzRDWF
TLSH
T17FE4128633F820F5E297433D99E44A81E3B27892573593CF1260C6A63FB79D15E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f2169abfbead8706d8ad6c59a062477f8d24ef05cec74134a64f58b08331c1f
MD5 2b1f9b8f3243496d4117aac84d5ea523
SHA1 64f64476295d20f4f74ca33edff4bb0ff279f3a0
SHA512 36d84c8ec5d1198d7cb49f3459716d9ed1414fba4505c5b0bc445b41411bb8bd97bc6a49209e07750b1d7d4bf48c1868e4093be35c997774277228c60d955d2e
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:bQRQyi36YOcPbLvw2gAf+PN3+TjgiA
TLSH
T1D4666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f51cfadc3ebd3589567358e4524ac313afd05f1db76325839c1ba7f82eb9b58
MD5 d2015fe5eb8c8cba9f24f51a85c95550
SHA1 2bb54460e8e6b1002a257d38ded085f7bfb41d7b
SHA512 32b1c5ec77561e13148c06e6f1aadaef6e77833f8f8fcce58a6e4dbbb1d19d5bbb82a3355e678e6b421860940aab61acc65421da31ba4eb5601c58c5cc9b8615
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UJ:eQRQyi36YOcPbLvw2gAf+PN3+TjgiA
TLSH
T1BD666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad559390e385d7a2cf03ee98e8f3c597ae4fa717bb765911f25de84f875f5ff5
MD5 e07ff6424a862632877f9436cab0ff9f
SHA1 7dc715b0ac006e6625f2167f4c3d1bf0720ee6e4
SHA512 6a2c10a03474a3a4614db655cc4a28ef3e74f2630459d678001230960c53219931192abb123b85b9440e102a47256911ec60696716efe65a35870538206632ae
SSDEEP 49152:E68Qg55nhceWu7PNU3/hSvrJ2RIg5uNA:uthLRc/wTjgiA
TLSH
T16BB55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2b81b6ffc3f7fbf8b8a075b547772af02b1bbcefa564e68a782006929b922181
MD5 b1fd00b5dca6b95b079dc6c7475bb872
SHA1 c8b14bbdfbf847dc39ef6ee618c117a31848aa77
SHA512 c453576fa309770ff4cf367fc2f4639e6de040acdf015c81cfc0f42b1b0dd46a8756fa513e0427565fcb98f1ebe815028a703275f713d890c93e7bcf221d06ef
SSDEEP 49152:h3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:gy5112gYy5azzVvt69nLKnhZpTjgiA
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 87cdcbd432e694688556362176df5965980d57127447c0f34c88bc6bc588d182
MD5 ae721e16e5c777b8c96b90e2246decd2
SHA1 a3e3be66c491cbf83d69243a6e0475e5aef616e3
SHA512 86ed8aabea25ca0162dc128046135aeb9c96fa3acb9fb06a938155a393777f75d4d842e3ebc2e058dfc0c256e9d3f125f188655f5592fa246ee5bca89c1ebb84
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSSvrJ2RIg5uNA:6u6Jmdxd2dvTjgiA
TLSH
T101D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cce070671616dba8325a7a191f76a99dcc66bdea4e2d7004f3ef251c8242c011
MD5 bcdfb9ac6dbad2d5abc5ba7f0b3c02b9
SHA1 b5b69cbd72d4b91244fd2fae8e6017894d30b309
SHA512 363adc577f9547ee8985ba3e0ee419c2adef3e694b95ac25eb07114df3c1b5f1aa620976dfa2b79e3319515ea6c47bab21796009552f15dfdd811f80a986442b
SSDEEP 49152:J1hpsNoJpF1A63U44CwH7R4x/SvrJ2RIg5uNA:JmifPWRfTjgiA
TLSH
T137B5BE13F2D900E8D05DD17887569632EA62BC460B34B6DF0A90B7962F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 961219a9a8afb5fe85eee363501f44399c0a474e3e4b7d924fb1ae86ecc68b42
MD5 457a51b8b8080c2961dd886b5f26892c
SHA1 e9c0e5ff5eb8d283ff5fae363e757bfd240e8472
SHA512 f8a7c85fc2ee04fd49b3444919f27407c6252721a2a9053bece343fbe8236bf18aa32ac01e0ab88a54022f4ecee45d6c9028618f9d7405526c36e0c6441dd961
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHqcSvrJ2RIg5uNA:o5dKii61VTjgiA
TLSH
T101C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 12dd5e5529c5853ef34c5e7cd9d3faf0cb8942dbce85212507a9e4e5b26df7f4
MD5 1e9704f4079b57e14c85f22a313b5b41
SHA1 b2fab2881b863d80427f52fd2e56b81cd17bc8b6
SHA512 1bd75ea51c12c7ace5e3c88250322aa0e44c7664213b7191afd0b5dc5d1473e547a89766e4a425d644037a7204bed56907511e3b94a0a8fc53b504f096460e5e
SSDEEP 49152:XhtSn8EApI0fig3giDn0AP5wjSvrJ2RIg5uNA:GX2imphzTjgiA
TLSH
T12495BE13F2D900E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 eb9cc7cd4bb66a2fadb0de92002539b920c46d49b48277773c115f97f5f183bd
MD5 f7bed915d5fbb7397287184b7720f833
SHA1 3b89f2450a7d661cb6eed78e3918029cff4333ad
SHA512 5ed7658900cac0a8c978b85eeadf93db5491542fe21a78fbdef127960e827c47e9ddaffc8dbe93dfc2b919e8d34ab3ba4339dec480321fea3caa90fed3eab84a
SSDEEP 12288:/gkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:/gkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1ADC43341E9BF54D6F6044B36224409D1B2D93CD7DD26B30BA298E4E377FE4D1AE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 0f7f48072bd8f5fe9593e46c22f91fc77326942a25d033819692a260eaf89630
MD5 db7fc140c4b5189f01127ffa781f270d
SHA1 ae9e8e4bffad0569bb78f1eb0f953948347c2e95
SHA512 78a998e510d8d334e18482a75a36184a942a0f784aa20301a3b69e73bc4c6caf9a7bfa0f3bcaa0f8f57396b957a0825bde64c7b39b6ed9797acced628c4242ce
SSDEEP 12288:jlkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:jlkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T177C43341E9BF44D6F6044736224409D1E2D97CD7DD26B30BA298E8E377FD4E1AE1AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 b56dd90a78e7126d94d5594bd77ab9683cd2f3625ff54b0293b22e0dc32c3f71
MD5 89332d6a485ff820661a61506950be3f
SHA1 2fff813fc6bbe5c3b0748dc398cfcd812d22f1d7
SHA512 59b57f98418c8081ee1e5eb0e1d12edf1b278f6160ff55c1661a707ac3b6f7adea5d3117326df9ef0294d7de9b0a6f99b39cc4ba565aad2cc22a4bed34732d26
SSDEEP 12288:LnkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:LnkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T17AC43341E9BF54D6F6044B36224409D1E2D93CD7DD25B30BA298E4E377FE4D1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 99c2fbdd9be165df5f0ea7a3314d540bf5c6f15c7c48c39e30aa62682095e90b
MD5 bc1bf6e25d54ee5755ba47f5b4c3c3e5
SHA1 71e073255e343130398e03af7bf4fa5280145341
SHA512 ca4e60b288970ef7e844edcdedb04ba1b77bd5824ef595bdd610c488a0e0a871345ab8a128cbdbdf02047748381c9ab1e57b25aecaf06fa282f9ca144489b1c2
SSDEEP 12288:3VCkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:gkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T162D42341AABA00D1F955873A965009D1E3F67CD6DB32A38F9650C8933FFA5D0AE39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c3a9d646497ca02e4a0446fbd52f1ab4ea5880564ac0cf70c0cf449d2a6d4531
MD5 9c852971ca9807db389f0091577722b1
SHA1 cdd3aa5bff5accbcaaae76a908fada72a4e165f0
SHA512 31868c8f41265bda604752b6e9869f59e9ba8e41faa624b45e0b22f82c1991894ec55b966c6e0ae696e6d0ec7ae7320bdbffddb9133492910b2d438e20684387
SSDEEP 12288:j6kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:j6kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T144C43341E9BF54D6F6044736224409D1A2D93CD7DD26B30BA298E4E377FE4D1AF2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 56c2ac0978133d0e0b154f6c31912e1b2fcb34fd3315c4c34b91dc8fcc4dd85b
MD5 8a27e042c7ed6b08f20014f70de3224c
SHA1 cf5a260e3b0ecd978e75a08468effdfb589b358f
SHA512 629bb09d57e33d9a834dd2c5262e402592468d10119ba81241a846e433801dd1949da0914d9661643735db5e8a0319be6ebc10e2a2977e62dbaa89bdf21ecd2e
SSDEEP 12288:OZkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:OZkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T113C43341E9BF44D6F6044736224409D1E2D97CD7DD26B30BA298E8E3B7FD4E1AE1AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 27570e54c05e02d0d6bdbb264dc8369108c1cc4cbc222396aaa52840dafab065
MD5 d0e1fe46a0c9f2a8bf93833dda23bf7a
SHA1 9e4ffe34ba85132354005176fcef3cda01ea9053
SHA512 3976a693e0598752a562a31c92fe84fcfe41f18ad83785e936d2da22982a0e24ee594f9c003b6ee16f951840b3287a2d52a8e18a10d17d3e06cbe9818c197cb5
SSDEEP 12288:qdkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:qdkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T10AC43341E9BB04D6F6044736234409D1A2D93CD7DD29B30FA698D8E3B7FE4E1AE1AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c0eb0b489d7a3ea220e4c5c7ea775dda7f3c4de237b033071409872e7061f35c
MD5 6a87ee6dc5a9566925bec2b6ed3dba15
SHA1 26d313698ae53763092f7adb45e2ce69fc1f6c55
SHA512 6295fc9e85eec1f016cbf061824274c2f117bbd73a938a97c65b871f57561c500ede5f22d67bb658058bf4630a4d01187d499edc828b563a9c7d17a7ce77c975
SSDEEP 24576:/ZMRzFVSOFkzhvrJ2RRaPYHZ1INzRDWF:/ZMRzfJSvrJ2RIg5uNA
TLSH
T119050195B3A018F8EC67823E89158942E2F27C5A0B70C61F03A476676F773A11D3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 41781e5e2a75cf99071e3fa0459fd8ffe6a700fa546ea83ec516d24b2269a73c
MD5 3b9d4b6f529f92102459e316906be7a0
SHA1 2de37287cef698becbbdac2223c3b4b5d3200cba
SHA512 40dedfd7b5c4238524edcb60691591a43e6a3743c4e0b2ac964b8e9f73994901ee0d4c4281c69663469c130e7705bc227e817b1d602ea56e7c527008bb419676
SSDEEP 12288:hMkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:hMkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1C4C43341E9BB14D5F6040736224409D1A2D97CD7DD26B30BA698E8E377FE4D1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ef72d8222698d2929474ef4047a6d225128b6d818c23928409e583c49768de6b
MD5 e92cbd84ac759f6dd21635a99f83dfb8
SHA1 8d8eea9ca67c63466901b1823a82b4833a522a6d
SHA512 5702db23bfa61759fbec275fa61a9e269815073299b1f6dbe02865f9ad2104e28254f93cb5f2e6718331e34c9034d1a2f7ab29a68b5b2dc1630982fd60a16bb4
SSDEEP 12288:hokbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:hokzhvrJ2RRaPYHZ1INzRDWF
TLSH
T184C43341E9BB44D6F6044736234409D1A2D97CD7ED26B30BA298D8E3B7FD4E1AE1AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 978bc9c14d71dc183952f1de2f2b44853cf512bf10e5cffc7838b2d89d33c14d
MD5 4c6acf027cd91c5677c1b4596c8b71ff
SHA1 1f09eabfb386bb3e3fb3679a83a1c43ce629cb05
SHA512 3f7d7b259066efea6b94ce2e48cd4a7b85910700e566606aa94bba1343762f4206a41404214eebbe737f211fd9523778be3d3d54333bad8aa79b3caade4f0068
SSDEEP 12288:xyPz5L8BkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:gzyBkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T128F4124773B530F9E126823989510A42F3B278724B209B9F53A486B73F675D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 be43ead2481d8135bb0b658e63035fe98be6536ed6439cd65287d89ee734aee9
MD5 aa73171d668d2b0e009c66b2b01adfd8
SHA1 c206e7fc300f30429117d56eef1e275d1fda2175
SHA512 86ae96891850bdde95c9eb611f26bc55bc04b89a47e71f31f379284b43317b99541ec789c0167f58c2fd5fccdafa5e2c89b225ce883a833f6243f3a12b4f6a66
SSDEEP 12288:qMkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:qMkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T150C43341E9BB14D5F6040736224409D1A2D97CD7DD26B30BE298E8E377FE4D1AE2EE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4bea547dae9399120107c661be6f82ecc7923e66ca100a501db4a728fdb7bc5e
MD5 70658549fad9ab4eacce6feaf60fcea3
SHA1 c3c06e190f6727ad20ae89e2321fcdd45d9b0b5e
SHA512 a58d9e76d9b28c124214dd34443b2d1f2f86b80e1d43479afb1767b4a75e677f073ee2f93f37a1401bbee0ab602824464fa8ad4e77bada813dcdb0735bd67029
SSDEEP 12288:cMkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:cMkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T18DC43341E9BB14D5F6044736224409D1A2D97CD7DD26B30BE298E8E377FE4D1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 88b6c52510beef7f0c1550d2db1b0713cf5ff4ffa23511616e392fa66c3f84dc
MD5 1f6cf662752503ef22dd92c59651f5da
SHA1 2da3e9333ae91be285cc49210cbf86f436839a8a
SHA512 0ac4b50298c0ca8b22c18ed8e79ee114965a56a2f39248abc2088c4b6ae690f60f0da29f4819cad2be9ed74859a192c23e6b820a6e6ac6715f7916ef60d8bcca
SSDEEP 12288:wyPz5L8BkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:BzyBkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T176F4124773B530F9E126823989510A42F3B278724B209B9F53A486B73F675D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 04942ba835a4e6fec7018754b3838e621cd1cbf0de6b35da3951e40888e51bf3
MD5 2818eab643fadc05bddfea6d217e5123
SHA1 1136b8077453f296083209e97ffb3ff119b2507a
SHA512 f0b02d17b974f279175b5f37630702f0c9834fee5abe133dbcd7251d167004c97fc9af2804c1481e6077f46e3219eeeec172377ce12f00235eb4cd1e7820d7f4
SSDEEP 24576:0TDaLl3z0zD3kzhvrJ2RRaPYHZ1INzRDWF:0TuLljGSvrJ2RIg5uNA
TLSH
T110050194B3A018F8EC67823EC9558942D2F27C5A0B70C71F03A836676F772A15D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 2a35f8e3bd582d6497b48be3d211b1f5ef298acd7f43d58cf9babc5c829e08c8
MD5 b811e41bc4b7c842dfee56b2ce215c14
SHA1 31ca7f81c0c86bf1596dee76a9653e2409f8a6ed
SHA512 e23e65c1e8e48b542641adf77866ac24e788fb3e4f05c94b02babe7d9ee4c975fc4d09a4f21bff013433f9fad7d0932bf56279ba30b183252b400019a8ad4756
SSDEEP 24576:+3vd9CHKy7GZrkzhvrJ2RRaPYHZ1INzRDWF:Avd9CHKyaJSvrJ2RIg5uNA
TLSH
T16B25DF90F3E410E8F0B78A358D764511DAB67C9A5B31DE8F03A4655A2F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0bf59d2ec003468f638602b0f354198693f07ff0b944d566ad4218a7acb2a188
MD5 89dfa5c6015a2600a9f0455f824e638a
SHA1 0ad9759c937649f2589552681e7920c134d8ef80
SHA512 c5f4e0cd3537c21ced2b9477e447ed42762ec4d383674d5e97ec8d52ef6983017218a25b59e43bfb5752de249146f190de170ea52f65bd6b064dc5a66af03d0a
SSDEEP 12288:RHkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:RHkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T133C43341E9BF54D6F6044B36224409D1A2D93CD7DD25B30FA298E4E377FE4D1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 84e4ed8936be75a0254903ad2314b8d37ba6c06cbef708a63934b7e8c9a6ecc3
MD5 c82af328e674cd1014416905b2155b06
SHA1 6c3a44f1b33a375b9daa9080af2509382d2a946d
SHA512 6316905a5eab8a3d9eb1e366e165c49d89da6b180018f04a1b1ec953c46d4f367f60d6574385d0ce48c7895ec5a93c7459eff2aa8b546274eabcff7103fe28f7
SSDEEP 12288:DhkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:DhkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T182C43341E9BB54E6F6084736324409D1A3D93CD7DD26B30BA294D8E377FE4D1AE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 bf87ff4d564fbb66f84cd04332517dc406407d87c9d7cbffa7ee702b19c6def5
MD5 e108d3d06cabaf8df00e13231e176a22
SHA1 d611daebc5ea2a9e4751c43fd384c04b431c6fe2
SHA512 d454ec6f407424641e1ffb94f79a478d578d0ea900cb3c0014a877d9ad9b16068f12d9090df0b6fe2f4b1c720b9c3faa25c17d73fc0e99c3ce4d82d2b375d015
SSDEEP 12288:NekbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:NekzhvrJ2RRaPYHZ1INzRDWF
TLSH
T119C43381E9BF14D5F6444736234409D1A2D93CD7DD26B30BA298D8E377FE4D1AE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e908d156a581e3d1aed7e1a7e6df23e40c10647ebc4f27a7488918426a3b1c40
MD5 4714c9b60c746e39bdb95dc08868127e
SHA1 a61d1aeaaf516852c4c0382fb47db8267ead2304
SHA512 3b89a4d189dd2a749614744203a171746e8795b5c3f8e8d6b964366f6e42d20748ace0f54724e40098f9d7024120f380c1e9b2e909851aa87f71bb4a8bdd8f51
SSDEEP 12288:HbsfckbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:ackzhvrJ2RRaPYHZ1INzRDWF
TLSH
T129E4F149D2A801E8D06E6239C7454A81F3737C6587E1D3CB52D0F57E2FBA5909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 4e3e8e0481b000d45d11aaa2eb1d52e364da0f9bc51a8152cbba80106688c061
MD5 72ca431104adc19be02d225298f6fb2c
SHA1 ff3121ac8215a8bac7210d18ba9e1e58d9dd3af5
SHA512 a3d7679e0d95e99f9846534ef20b5148a272f8278ed190cdc8c7c3fd5f8dcb245b73e20767999ff67fa73be4d59ec49ff6b6b1f167840fe964388222d03ff282
SSDEEP 12288:0qkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:0qkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1C6D42342E7BE54C6F6695B31220448E1729A7CE58E25E34BB144E4E376FD8E1EE39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bcb77497a3fe2f31017de044f91077cdf5556c5df4f11200b7f5c00bad26fb46
MD5 480382887e3f56c0369d64b488a30b9c
SHA1 33a30915de0554d208b10d97cd9b298371a8d469
SHA512 387e56f4d603d9a1a99713fea84fb64a73f3480a500157535805d064584721ecd7b0e8e4caa465a6f3c6f3816d98adca85202f2cbf6f6a6874448b7160567569
SSDEEP 49152:sa0h2GEkuAe73q3pp46zwwQcSvrJ2RIg5uNA:sa0hNYG4JwGTjgiA
TLSH
T1CF859E1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9214fb14cfa5f72166a4043fae64bac795589328e355cbf9377359f8a3866200
MD5 c33e83c263a4b645686da6b71e08965d
SHA1 a92e030729985ae93f15b8490000366cea51370b
SHA512 3b7754c3a4f1909dfecef35eec824b6bf7e86689d174d39b9306775f1fb924ad4b80f307040d4a2517374c0e2e341a7fc14a22032740290213372ec27bc003ff
SSDEEP 12288:zhbHjfXokbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:zhbHjPokzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1E8E4126E66BC20D9F171A23D52414982D3B1BC660B21A3EF22D0C1BA6F7BDE45D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 625e14a629ba4a0ade4954a787f006634c978e3aa752a7fee78a7b88af922088
MD5 97e2cceedfccf2e6fbebed8c66753921
SHA1 fcb5fa08acbed8b61d93b20ec35f8952993cfd49
SHA512 dd3fbbe169a76cb258b0247de0f8370dbd912ee0f86da1a3f9e38a02f2ffbf0ce85e10ff3148c14c3172b2a5c97c0a7894dc87e95070c0748f907921126e9b4a
SSDEEP 24576:z3YgnJcRTk4yti+R5dBR/wkzhvrJ2RRaPYHZ1INzRDWF:zIgnaTk46pBR/wSvrJ2RIg5uNA
TLSH
T18445BF2DF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 57043a51672c6116935ed3c6241172dc1662a36da8446d6a88fe384585ec54d8
MD5 790bb539e047ea43b1be5dcaf52eac91
SHA1 7a0c9046564b1a0c7b4deec292462181cdbf73db
SHA512 4482a0d258e9a7318f9a5afec3d9f3413d92436d0bb02e0c6ed2878adc9c197142b2c0e415a07c4ae1749386014eec3c53535bd74d8e0ed512000e30542167bd
SSDEEP 12288:fOkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:fOkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1D1C43341E67E54D5F6444B36224409E172D53CD28F36A3CBA0A4E4E377FE8E6AE39E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 2962a215e7e293665d133cee0f8606acec4d2affca20be5f3e2a08af06f8b984
MD5 1cb79429ff22f6f743874608d10edcef
SHA1 74b4e7d5db16d1d29410f144393f3b6fff67b613
SHA512 023149bb6f8b5224aad866d117c36d2a2c69241b6b7f9636eb6670906fa783ca659f2e97c21a91e320857de8d0dfef6932d420d490bb66945c1f123f9ff2ae28
SSDEEP 12288:4ObfA4LWOsvAYFTpkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:VbL3UTpkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1BB250245F7A500F9E967C23CC5668912E3B2789D0764E7DF03A88A662F537E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4ecef46d5924a056ba2fa5a07a71adca678f9a8cd031fcb148dedfd4b8ada772
MD5 18efefed507e01ae70ef942e1d1438d4
SHA1 b26d99920a6cfb37d3b8c46aab691c6c30f040cb
SHA512 4943d5bea0f19831dfba16d82dcb2ae158fa97149d02ac2a86ba3daa70d9e4529cffb5012221bf3d4009cdcd8df2518f427e2c3a538eef15c96e0216e1ce9b78
SSDEEP 12288:XpFtIO9kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:6O9kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1BAE4121936FD10E5E175923D46824649D3B1B8A60B2253DF42D0C0BE6FA7EF8AC3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4ebb984065f0f5ccca26e9fcf6594f67165e1d0c74c0a76152fa9379f315ded6
MD5 35bf1790684994de42865a3326bcd16c
SHA1 90efdb156864856ee6e0d19bc495033964c56c41
SHA512 157214ac5af249ff0ea4fe870aef1dbb9df07e7b3ceb9bc99864b9180786a3df7cbcfbc2c33a55fc58dfaaa36eecc3919d4c41fc563bfdc5b51de3d30e84139b
SSDEEP 24576:h7NM9YqZqmWMUkPjZM48Mv6bEhsakzhvrJ2RRaPYHZ1INzRDWF:h7cBWMpPjN8DbEhHSvrJ2RIg5uNA
TLSH
T16565AE2E6BAC81D5D576D13DC9A28245F2F2B4611B318ACF1162833E7F37AE44E35B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fe836621e98e47555686a23c225576bbf0bf700a3e90451277194337ca13e3d9
MD5 abfc8ff7cd9b923f2bf9538703c738e8
SHA1 b85912af38c97c6d68dafa0d6f3fbf0b3f4ec4b7
SHA512 9143c53fd66cb1433e642d3963dc61ab32959cedd354b6eeb096a274529fac29fc5950d2881aa3d0814195a0ffd234b618734ff6fc4c600d3c5842e906f4fd5f
SSDEEP 49152:kF2YuHNETovAvNYf8km6SvrJ2RIg5uNA:x6BCf8k0TjgiA
TLSH
T107858E2927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ad164910f185cc94b8cc5a341936b74c4e360fe5f653ec49a3822deac6c6e961
MD5 57e5acdbc51c66a6fa679528febbba99
SHA1 32bb64b5bb177b0318296d97fd111e78704addf5
SHA512 e4dcda0e51745226f04d37142d2010bc0e9428b9d903549e449274d02a6bb1490636c52ba558d2c343b8421af02b5399f0ad7a77735f8606bdfc0c63071fad10
SSDEEP 24576:+AFs06+OmlfkNXEbToxkzhvrJ2RRaPYHZ1INzRDWF:3Fs060lwXu8SvrJ2RIg5uNA
TLSH
T17065AF2F62AC00D5D07ED17E8A97C91AF2B1746307255ACB0160C67E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 1281f9e272f9f1efc5542baada1e2a169d540a20a2596a0eaedc6c74b8d90ee8
MD5 22e256a1b5fd71369b6b6a893ce42272
SHA1 1aac68ef6b102656e2b1d6cbfec1ab13c1777677
SHA512 3103b5988c9d986b11a4b8320ed4069a7d28b95f5a3b75d1acd49cff4f79e3c420b58ed17efd0593c1e555a5b376f14cd6f789771b8ddb177056fa9046906632
SSDEEP 24576:/JnJ5D3WX8kzhvrJ2RRaPYHZ1INzRDWF:/JnJ5DGX8SvrJ2RIg5uNA
TLSH
T1AC15D02DD2A810E8D4B7C274815A1B96FFB2387D2F226AC724B4D5353F16EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c242110c986d7285134800f13aaaee2ae22b0c8395c75e098a5465ecb8dc66c1
MD5 1cbaa0d3d493e462f3b1a152e3d83213
SHA1 58df90cb7696dcc0581835257749c9c34ee5e4fd
SHA512 16cef2735e9f3807820f30c863a10c6e20815ba58c7e5c92cdb7fb4eb4390ffbf4d08c74be0f3b9a561854fc6c82f6bcd8322c30d152ca7bdcdf7f803871a18a
SSDEEP 49152:4g06DIKdwc+eQnSt65aV2SvrJ2RIg5uNA:5ZTjgiA
TLSH
T1A4956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 fc5afb4d8e9835fec8f3199a6053cf3ffe74d5fe005f96946d510b1041eca5db
MD5 ca919523abfd259f001d538571789d7a
SHA1 6671ebc30493fc5c063d14b5c02252e1a03ab3d4
SHA512 12a76c1030049c2084b8a7648c013a982daa791b1f1a47164e6b26f78cc22ce8996dbaa242a69aad25ee782bb16f03afbce6085b4b105f8d3dcd831604ef2da1
SSDEEP 12288:SEP3Rn3kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:Rn3kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T139E4125D67AD60E9E12A923D51808581D3B2F0B15B2223EF52E0C17E5FBB9E56E3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 4c646fb6fde71e052019fd13e012c1b285f7cc9b1eef889bb7f41ffacb519e9c
MD5 25f981abfcb9c1fe8d20e17ec53bd141
SHA1 57c1686038d6648f2e02fe2b2e39e5b320d8efaa
SHA512 ea3dd8ed695d103c6ae4e53c42945135f0e0992753f832370cd11c8004987f94c995e92004bba1586cff7bbecc8689f717f57bd95beab93890c2f5411a6cd318
SSDEEP 12288:ljky3kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:lIy3kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1C4F41204A3A860D4E6B50738966241D19BB5BC609F21A3DF60D0F67F7FBAAD0AD35F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 4d5ec6cc7733df6d4ff7f2f493a6d056861b74565080b2c061aee8bfe8e3cc09
MD5 71ed7c344acc9ea04e4405ba23d5acf3
SHA1 778c24ef655e7e4707c2ed402085cb90b901a56f
SHA512 16422b540b1a31fcd6bd03d3c23228558d01e8333923dee4862985fbaade07b4b30d0af724f68af8efc6744e94e43e6d8f711751bb8f48c45ba25b09ba3582aa
SSDEEP 12288:7yNkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:mNkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T161D42348A67A20D5FA05473522140DD1A2E538F59F2573EF60E4E4F3BBFE4D2AA36E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 ed0e00003cfbb6ef59d4b44c871829ee2a08396a0d58e14e080ae1bb5753fc63
MD5 1a56e23b0560b53ec85ec1fc65794b85
SHA1 be2ca4c96ea9dd55e53575e496ef67c690cfd0ef
SHA512 ed9450f0fe7d3e613a4ad69fac32f439d59daef224866d5fc227a8c5c0e67392bcfe614b1542f3c47dd0ee652938e28bf0cdd5ccd49dfa85228a4d067471a514
SSDEEP 24576:CQ9MxZKdcz9dw3ikzhvrJ2RRaPYHZ1INzRDWF:CVKZiSvrJ2RIg5uNA
TLSH
T1C5558C2DABF9058AE177D23595A250C3A673B4311B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 2b999b05b4e6bd2e9c4113f3a09d0e8ce07a2fdb498e240c2cc0e5a0ab3d2329
MD5 e4f4d64c340f0ab8a251223da69348fa
SHA1 da63b8a7d4498c22514ea1a4f5188b2c5ae8bd7c
SHA512 98fe735f91be26b9d6dd33bf2e8d4276eaf72b616893b661d333fee62ac237d72f4dbf9ccf671aedc183f2957bf6a9e0fe553af335ba368b9a5a361df1d4d3b8
SSDEEP 12288:ZyoKo2JRple9p7kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:ZyocDAp7kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1DCF4F10FBB6E40E2E166823C89858745E7B3B0705B6263CB6590C33E5F679E9BD34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b19ae286b7740c8b3280963d6e4b4e99d417752b3d791baef7b1e77918aba2d8
MD5 e7a59b00fb289469d4d9f1d34c04cd7e
SHA1 24d2b15d01844c305ea4b247f30e3ef916fc273a
SHA512 c67e899b6611f11796d7d26f26dac77d0c09411b631bfbf2dd8d6837cc560b8eb7cb5e60f3d8d84c763ac9894a385506d812715bc409791015eafebabd41f591
SSDEEP 49152:GWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK7SvrJ2RIg5uNA:Q0zuNIYTjgiA
TLSH
T1EEA57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c2f347c14c98a06e01bc85ffb6c2ec5e06df500ddb0510c2ae623c02ced04ee0
MD5 efee10e6f48754e1005bc1e78669032c
SHA1 d2467546fb12add0eaaf9536f246e9152430e6bd
SHA512 afd29da3119d99498ee31537817b751ad42d2618a85b14e73c91089a38818b668987f22da379eb1a1f7514ab3309658ed7a7e0ae42a4d1284b3c6967c2dc3465
SSDEEP 24576:B1QT7EcpfxR+N5AWAz3ooiYujMqb3kzhvrJ2RRaPYHZ1INzRDWF:ETDxR+N5YzT4jMOSvrJ2RIg5uNA
TLSH
T1DE55B02EA7F815E9D17E85799A23C502FB727861033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-302-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/456-299-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/644-308-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/644-420-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1160-340-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1160-487-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1160-372-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1160-356-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1160-321-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1160-399-0x000000000CDD0000-0x000000000CDD8000-memory.dmp

Download

memory/1716-408-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-434-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-445-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-446-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-447-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-444-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-443-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-440-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-441-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-442-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-439-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-438-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-437-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-424-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-425-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-426-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-427-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-428-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-429-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-430-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-431-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-433-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-432-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-405-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-435-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-436-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-423-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-422-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-421-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-412-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-404-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-413-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-414-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-415-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-416-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-417-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-418-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-410-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-411-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-409-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-407-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-406-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1716-403-0x00000278FB020000-0x00000278FB030000-memory.dmp

Download

memory/1728-224-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1728-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1764-401-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1764-296-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/1840-263-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1840-315-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1908-270-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/1908-394-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2400-397-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2400-273-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2400-280-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2400-274-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2512-8-0x00000000025E0000-0x0000000002647000-memory.dmp

Download

memory/2512-0-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/2512-36-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/2512-1-0x00000000025E0000-0x0000000002647000-memory.dmp

Download

memory/3136-24-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3136-25-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3136-16-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3136-225-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3176-312-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3176-453-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3208-253-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3208-254-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/3208-259-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/3208-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3284-402-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3284-304-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3360-285-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3360-398-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/3360-292-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3360-286-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3432-56-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3432-50-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3432-58-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3432-71-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/3432-73-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3524-249-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3524-239-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3524-307-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/3524-243-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3940-266-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3940-419-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3940-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3944-47-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3944-226-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3944-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3944-39-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4044-235-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4044-303-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4660-68-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4660-227-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4660-62-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4660-70-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4924-486-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4924-316-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5004-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5004-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download