01902cf1b0bfcb444892ba1758c2e90ed18e7d657585da33f1aaff17330b6e68

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Size 3.2MB
Sample260503-krshases5x
SHA256 01902cf1b0bfcb444892ba1758c2e90ed18e7d657585da33f1aaff17330b6e68
MD5 eae063c8664fc63da9179db471eb5549
SHA1 fef342cb9c03b8e590e823094143924fee2041a7
SHA512 3434cc531d82d7965401850919d2920afa8d522684677489b383bdf8368aee67d9ccf6a694cacbe2b1341a95f2b331b2770c87ad394afa1df1f36fcb7fcc9bb4
SSDEEP 98304:Hn6r6+0FUFIIsTY9Fl/7boUi+XwZPwMQBW/KMZKWKKFTkFdRMkVTKAZGToClTjgB:Hzcl/i+uPwMQB6oV
TLSH
T1CDF5AF227761C476D1732530966AE378E1E9BD310D39423B62917F3D7EB0A42E538A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
5060	alg.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5824	fxssvc.exe
2736	elevation_service.exe
3224	maintenanceservice.exe
1108	OSE.EXE
1780	msdtc.exe
4820	PerceptionSimulationService.exe
3972	perfhost.exe
4560	locator.exe
3172	SensorDataService.exe
2880	snmptrap.exe
4944	spectrum.exe
4620	ssh-agent.exe
1200	TieringEngineService.exe
4024	AgentService.exe
4648	vds.exe
1188	vssvc.exe
1464	wbengine.exe
3336	WmiApSrv.exe
5360	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\951c64f8da180f68.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_172312\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6128	2376	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093ebf223dadadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062a8b124dadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017bd5c2bdadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1b1d823dadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c36b4e2bdadadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076600824dadadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e3dc323dadadc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
5076	DiagnosticsHub.StandardCollector.Service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe
2736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2376	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
Token: SeAuditPrivilege	5824	fxssvc.exe
Token: SeDebugPrivilege	5076	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2736	elevation_service.exe
Token: SeRestorePrivilege	1200	TieringEngineService.exe
Token: SeManageVolumePrivilege	1200	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4024	AgentService.exe
Token: SeBackupPrivilege	1188	vssvc.exe
Token: SeRestorePrivilege	1188	vssvc.exe
Token: SeAuditPrivilege	1188	vssvc.exe
Token: SeBackupPrivilege	1464	wbengine.exe
Token: SeRestorePrivilege	1464	wbengine.exe
Token: SeSecurityPrivilege	1464	wbengine.exe
Token: 33	5360	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5360	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5360	SearchIndexer.exe
Token: SeDebugPrivilege	2736	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2376	2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 3272	5360	SearchIndexer.exe	106
PID 5360 wrote to memory of 1080	5360	SearchIndexer.exe	107
PID 5360 wrote to memory of 6024	5360	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_eae063c8664fc63da9179db471eb5549_amadey_coinminer_darkgate_elex_emotet_mafia_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 900
  2⤵
  - Program crash
  PID:6128

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
1⤵
PID:5800

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3812

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1108

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3972

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3172

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2880

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4944

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3272
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2900 2908 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2940 2936 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a60e60efbe48962a7999f7aa61597b4383a23833ca88eb9812d4bdaf9db9feff
MD5 280bb621402b7d881a87c5536abe5a07
SHA1 fb48c8baa5c98e3a37cb61eb880b6b575321887e
SHA512 5f8861b5e447f72d54c66f06bd6183b7c9ada5dd53f55f7b518dfae002c7f3647fb997789426d4b67579a3dd6f5aa1e7b7a1a2f5549c56ed3b128bf8c5727e95
SSDEEP 49152:Jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9SvrJ2RIg5uNA:f3q6sjBPTjgiA
TLSH
T152D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 54ab0d8f5234d7b5e4a144189a19b87aae09648c07cce25f6a12a9c5d6daa55e
MD5 960d5501d93111a694ed31cc3b3ad8b7
SHA1 87e776ba42cc2ddbbee85ba06afb0aa4398f3138
SHA512 3fb8ccb94bceac56bb2360b9802fc19563e0211226fda2ef0e896206bef99b40105813f4f09ae1a732ff6c38131fbb279cb208b83cb8efbca2d96237b987d846
SSDEEP 24576:nXYfDtczA2kzhvrJ2RRaPYHZ1INzRDWF:ytc/SvrJ2RIg5uNA
TLSH
T1E4050128B3E508F9ED67823DC9A18512E77378914760E78B03E4D9662F632D85E3EF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b299934d96a0151d1ad3703c06b94e7b18410a9fc0253cf8191c0abbc8dd6374
MD5 7185a9d38b3592510aa6fd8f4cf5323a
SHA1 b8e72ad5f329a01b446a9c9880978f9a63bff7f5
SHA512 d86aeb50c58af05069f81c81411eb089106eda29a70f5f4d2195c7678210b8bf3d9e8980f67d1dd889a0c247ca0b29784ac4e8c511e1fe3ee08cd28bea53114c
SSDEEP 24576:b0Le5ji0hmxxrM1kzhvrJ2RRaPYHZ1INzRDWF:bPji0Aj8SvrJ2RIg5uNA
TLSH
T14835AE16F6748371D073C0B9C5D2A69AE97130825B308ACB4286D77C7F67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 567997aea6ce20ba68e8ead2aeccdb0081d3b02f006b930457f06aa0cf31cd81
MD5 8896ad50443a911b24ff27f596dd423f
SHA1 dbd4b0a6f622ece96e8af4d2e7102aac050c0a3f
SHA512 4db4bb2a38f77c52d4916e474b1faecabbdb6339ba1e1e188eb5d401be2349ded313e4e2db76fe20e6fc060b7181168e99c9db5ab50fcbe5f3b00249123ac9cd
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuPkzhvrJ2RRaPYHZ1INzRDWF:+/ezSC6vUzPveHjyASvrJ2RIg5uNA
TLSH
T105755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ab0a77f9b18e40fa24a0096e6287fb56c76fb848554cbcf4e3c1e991f87c4e7d
MD5 8030110d08f62d32cd9c8af15b3892a2
SHA1 478d274ec97dfa0a4a34235fac8526844cd6356a
SHA512 cc580138d9e98939e067bef3dbc936e23dc8000ee0aa4231e250fa4e51a31c94b8ec0b8d04054df7e13ce4c7b2c4c20d76a9a3f545c32170848aef4877c39a0a
SSDEEP 24576:fVbqPb88hv/l+YCkzhvrJ2RRaPYHZ1INzRDWF:fVO88hXl+XSvrJ2RIg5uNA
TLSH
T1E3559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 be42cd64f8a7c1cf841f7f0d79f54859efb6f5e4f0cff375cf3a332247fc4885
MD5 96c9d9cca5fe84985e9f4c296109ed50
SHA1 a0a73de03c0d00a8cb6f153a3f2bb8502d901b90
SHA512 6dacc132daae3af9870acb2fbfb5b0373631f8b25b01c46f5e31d0eb0ed2f05a6591dfefa3bb47976987e22cf5e31f677079f60a24804ad81dbd9797a395edb5
SSDEEP 12288:+LBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:+LBkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1CEC42341D67950D1FB990B3632581CE2A3E67CD1CC29A70B95A0F8E376FD4D1EE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 0dadba372d62ec5769d4127e221dd02e4800fedc0b948f3a6ab9bfbbe3da8146
MD5 510c19241edfde0d5a4abd0218201f5c
SHA1 aa625975dfceda5a65a1fec073ed46c7119f6595
SHA512 4140dc1129378a9852bc2499c15ca7b6911338a9cb1cce80515559bff72cd1420edb7aa9d91279843b5d8def3310ba36a90f7cc46c8be9ba6f8d45056a3afb0c
SSDEEP 12288:weBNUbTVO86U6kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:wJIU6kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T10105CF2BEE38FCD2C27A4D7956918640E7B278704F22A3CBD164C24EDE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 49ff61f070377af45f7aa7c405e4879ff7fe000bc0ec4cf317ef8a51125403d5
MD5 aa1d03282d90f3f2e040e26f76a39c80
SHA1 77809354b691f1b908cd7819b31ee4e8bb8efb7b
SHA512 31b95595a55c6d5587f89298a75752df3b48b9ad9e6c30cd2831003c3ba6d3d6efdfffab93c3124da8877057b6a83f38e30881899b28b05a4a919d76c6c69831
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:EQvGAdlCEL8c/DRNw5CKTjgiA
TLSH
T1A9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 bded173a2d55faa7260496e954306189b03f268f51e4a8971720373600cabbd2
MD5 e44e60ebfddca8eea1a83cb9b66b3b05
SHA1 48ecf6e1bb16d6895a5566deb7d97a16e5ac4948
SHA512 cabf8a62bfd726f1e5619f2c56335303892abf06ee5504475cf576ecb252302c34c1038dbe3d28dfa754e0235fb297072fb31622f1f527dab5d926f644a0924a
SSDEEP 12288:vAwSfxL/2Dc3RDLLmt0LDQewsAjMkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241Dx:40ewsAjMkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1B315E031FE74E036C3BB0DB22B26C716146D79604F612AC3E3A88E9E59741D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e5867dbe3ef6d3e85d9c153881b4c615cd436993fb4163062d3818cef06ad453
MD5 8a5a1af6048ccf6fd251c4ca9f278b94
SHA1 b922fe0f38c57a8a6335e4c39d45bf14f7df0281
SHA512 b82c6c45250d41bc901a19f4831e1bfed4e1855180e201955b99cd0ed25d6ef7416c129340eb7c0aa455d482eba394337d58ed3c376b31330cfdf27e2d592307
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHK:ZUEtQevvqc2W1cpV2tI32K
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8269537f45e1e90cb34110f149f6e21a0868c70a5e82c322551185c8f746ae94
MD5 6afa787c51babe996835cd2fce0d7ef5
SHA1 a9a7dc3e901f19c66cd1b41f6aa43c717e9a202c
SHA512 210ee8ddd426ef509f05c86292866f806083f3675cec62148b287d42eca48a71fb5cfe1be3dacaba6fc3693a445a7d85261d88d8a96be34f317f1f0395205d0a
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zsSvrJ2RIg5uNA:KoqtVjnmmTjgiA
TLSH
T1D9D58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8aa5d7f82854ca37209c30beab0d0be5c1bf563d68836ad3d15ab0f46a798a5e
MD5 da0c54d65692c249aedfea0a34944fbe
SHA1 1121e309a19e633c43c0b37a5e83730cad88d4f9
SHA512 5026497af12e3f64b0d8929221fdc60aa1d590e408ab354964a8926df58fd6c728a7c81b571b2e913bda74cf1ce33c34e5ae0b8f61d1c7d2e32fc9a589dc3869
SSDEEP 24576:qAhGL3IFoiwtA5l7S53zkzhvrJ2RRaPYHZ1INzRDWF:qAMUFoiq5jSvrJ2RIg5uNA
TLSH
T1D235AD80E7F955D4F5B3AA7899B68570EAB6BCA65E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9cdf5a15e443e4e2ff03cd4bd3ab6bd672fb3abb4c7efc4ef873a22252a4b79e
MD5 8b5194b04c681e9d0bddd96294b63f64
SHA1 f7b64a45e226058147c1d7111b56827144d2fad3
SHA512 13d7eb26d04fe2d3b8690ee50e96e3d0598fae41bc31a7b7ab409b7b13ba2a3e7dc46c61dada06cef35c7764c2845908cbfa15b39beb562dae6fbe0e0563e7b0
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+CvkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpC:Twu4OWgkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T13705F14677A50CF9E96782398647C532F7F2BC422A21D71F0360C65B6F77261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cf04a39b9e00bc2f57e4c69ddfe23ce20057b9f9250e6ff0ea440b7842552842
MD5 0da10e96585779f9cf95664d1f3bab6a
SHA1 297a87f020fe89a073e7ab2720cd35c0bcb96b4e
SHA512 39db1df3e1e22cfcdd82fe59004eb4afa3dd5f5b967031b1228dd4e3e8525e1b3d00a8fca312776e8f7b0b8254154298e15baf50d4799d87dca48470d0c560c5
SSDEEP 12288:aeZ1IyckbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:3ZuNkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T115E4124633F420F5E297433D99E04A81E3B27892573593CF1264C6A63FB79D29E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 01d04dda588a887ca485c5737aee4ff5e784d49173a64dde14516160fb0a9d48
MD5 59cf2dfed8f8cf5222c43c0f89bc0064
SHA1 76bc14ebf6e657ccad122f94e94cfdac85d142ca
SHA512 65b5cf0440eb0db8a7f99690628ef9615dff89c34db959132e507ad0c2022f736969d448cc485f7de144727b3376621c658837c5640784d4c63edaca8ec88e51
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:5QRQyi36YOcPbLvw2gAf+PN3TTjgiA
TLSH
T1B0666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 582b4002d27495fb3fe6c14dc1f7493a23c9c044f52c66e79b8985c3d305caae
MD5 1763d4e99c9ae2ab4b3071aeee87a0c4
SHA1 886e5f059f8b659a19db6707518f3539ff28ae04
SHA512 80bf4b3078e1ae78c99f1ab2b45a75f9e39cc3654d84acb1a8ff5abb630d0a8e15f232d885ca4f36320d4521aa1ca07bfbad347787bbb294c8a580517e9be9c6
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:NQRQyi36YOcPbLvw2gAf+PN3TTjgiA
TLSH
T16B666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 480c876f27202a4135118e9f8b0049e3e9b5c26e52687286af34b917f4fe3c3c
MD5 2d4858338bbe3739ed250c52a34f9e74
SHA1 c4d76d0c2752358dbd7147914c12944053f4e156
SHA512 8c779761fb1103b4f558281fbee91c45347785a60fe5cb93eb6472cb2a37979e4f620aac6f9a239b087ff31c7187f74c659c0ae5c4245eef0cf3f5bf7689e2c0
SSDEEP 49152:a68Qg55nhceWu7PNU3/8SvrJ2RIg5uNA:IthLRc/1TjgiA
TLSH
T143B55933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 12cd9036dce1727138b5b6bbb3b7bdef4a77a74bfbd94657889d9535182e46a4
MD5 4201d57f0a5d7a9d8e5172c4dd778284
SHA1 fb3be010846e566f755e8430196372e10864e673
SHA512 d0f2930e3faa92204d8bc0fec0a0c8073a19066e923fdde542ef7c3c7eabd5141463baa2fd8bcb355d8e9fca46a1909a1c45c6b4147dbe3445d84a3139904e71
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99c:0y5112gYy5azzVvt69nLKnhZQTjgiA
TLSH
T156167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a0c6bdbd90a8b0deae9a902b2e009ea1a9d4404eb80db9ad7f53495e89cbbd2e
MD5 28fd1eb1bdec391b540e20679b215fda
SHA1 462bfae001582f469f040ceedeed073c1a7376b9
SHA512 78e8a65f83c8a81fee6b562dc874ed0cf47c3d8c2c349dd44348a08080d06b1432a858c2746e7658b5da29a9197c88460d52c8ce1f1c479c74ea55f678e1a8ec
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glySvrJ2RIg5uNA:6u6Jmdxd2dPTjgiA
TLSH
T1ECD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cd838ce3d16d5128b7441a8ce06ba97d2b86938d479bf9d7db9dd9a3ba1c280e
MD5 da9d87b60f60356ea369e7a03e2360f1
SHA1 554f4167d60951062b0e763d6e10d9f43f17119f
SHA512 630fae85dbedfb903347f55736ece19c8a51da258db4a812302217acc5bc3fe0713c4f6ffbd15108656d768245f5ea18c492fb5d2cfb563b1adef5aa11bbcd3c
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xaSvrJ2RIg5uNA:PmifPWRmTjgiA
TLSH
T1F2B5BE13F2D900E8D05DD17887569632EA62BC460B34B6DF0A90B7962F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7d1cd45e4f860c050c8c9b3d5729b17349933fbeb310e506f2e14bc8d328ca12
MD5 550d6d85b66cb0de2288aacb3f1b334d
SHA1 1554733937ac85f27a55c5f26b6883a644641be4
SHA512 cf1cee8ae0780b8a9c33428bed9584a881acc99014049d61b8d6d11884800184b9adf374afd81795d20976402d25c73de82fde2e2a914a861dae1cd16c987cf6
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqNSvrJ2RIg5uNA:x5dKii61ETjgiA
TLSH
T10DC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 49fd0662ab109cb52c0ded8bcfaec042800d5c8290428d583f7bfed6e3a4498f
MD5 c19f9135e719174610ab4b426edab0f9
SHA1 82de8a19a03743c2bf18c86b8b11663d137e6699
SHA512 2fc9155cdcdfbd5e863911c8387e3854c1a7d4112779f7c8a66edcae7e60d907c5846d8e22b8de3aee27dc0f87d712271452f9801e9b2520862b49ebf85902d4
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5w2SvrJ2RIg5uNA:LX2imphSTjgiA
TLSH
T18895BE13F2D900E8D05ED178C7468632EA62BC160B35B6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 832dec67577b987c7fd39f7bd50b02e610c10642054743bb122d99e7bf5d3651
MD5 aaee7b208b3f24e04ec60595d867d7ee
SHA1 ce8cecf348a682ea52d7fbe6d00f117e5aa870da
SHA512 fd64e5b0818f5a4e8c3f4f5e3d6c059089dc197484f66a2eb4f19c3d4df8e12e03855e7b9ae0bcaaa40f247bfd2d68ad1083f30e793fd0d16c0f36afb8ecac8e
SSDEEP 12288:n5kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:n5kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T136C43341E9BB54D6F6044736224409D1A2D93CD7DD26B30BA298E4E377FD4D1AE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c85576cea8ee1e80d262eb4e9aa7a060b7fed11b6b40a762cee7f1dcb73e476a
MD5 ef489f7c638f9e8f3a0dc29b964da61c
SHA1 e2e6fe48d0074057df195ab5ffd93e7b3670b965
SHA512 76b19cc8f49aee752c961639be8b107d9479e84d0a8a02115d6f625bdb66bdf0784d6183efb9900a97136a428bfe654c7e9b9a9c0682e7d897c0999dd2f556b9
SSDEEP 12288:rokbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:rokzhvrJ2RRaPYHZ1INzRDWF
TLSH
T181C43341E9BB04D6F6044736324409D1A2D93CD7DD26B30BA6A8E4E377FD4E1AE2AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 291d74abeaa98616d82fa40a06305fba06dce18c76e22c565c9cc15a38c9291b
MD5 e31782cf3e799bd19bd96d17508f0141
SHA1 5b14c71d59df5b9e57b572c6334cf5bc1c45d4eb
SHA512 a72d43c94b02271dba3d9454fe0aa180a9d3d8d597831fcb50df975f0148a04daf72a8625540a33f52d7217a338ae77d892cf468df2900ef4b9b93f6f179ecd2
SSDEEP 12288:yykbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:yykzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1DAC43341E9BB14D5F6440B36324409D1A2D93CD7DD26B30BE698E4E377FD4D1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f7444003015f120000dca920ef21ea073a26be3d82c3a7dcb04d753ae5005a88
MD5 07cdc1b38c3aac61485172a0d56c4fbf
SHA1 55763e8e1119d52de3efb632092a026506605ab0
SHA512 d484b614a4c7b15efdb67eacf65f78f4f436bc7d4b92c964ba3f1d7b8a0e4eead7ae04730a43bf094458e2135ee1ebb011b69e65cb7f875850d9fc7aaba2e684
SSDEEP 12288:bVTkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:NkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T18CD42341AABA00D1F955873A965009D1E3F67CD6DB32A38F9650C8933FFA5D0AE39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f6bcc77760bbd4af7c85b19fb99dd88e38c4306bda00394f3c9c7ee29bd13130
MD5 d815a5f4b42766f49a6bf5ea0a2b3573
SHA1 f4a2703fc597b3baad416f9bdeffbd3e645f954b
SHA512 32ac23eb2519e72ad4bcf02bef1e4a7b722afc3bf19838d2d70e33f9f9a0b9a7d65cadead82a2441c4976b88e4b7338e7342fd0f0685768a49585e0514975f7a
SSDEEP 12288:H7kbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:H7kzhvrJ2RRaPYHZ1INzRDWF
TLSH
T17EC43341E9BF14D5F6044736224409D1A2D93CD7DD26B30BA698E4E377FD4E1AE2EE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9b98dd89c2454dcf85aeb5a3c50ac8b5685caa36d72c18ff79397bf1d0646dfe
MD5 53d58349f1b6512f12900ca6db8e8bc2
SHA1 7b29b786beead65805bce99013cb4ace27494069
SHA512 db0d2da05f16b5fd860c6ce1b2ca26676dc04d3910bc33a16433a1fef0bff032f9176f1b99a894dcba710f5f1f325da68e1eb923b33dbb95f4161efe05ba6c17
SSDEEP 12288:hkkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:hkkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T10DC43341E9BF14D6F6044736324409D1A2D93CD7DD26A30BA698E4E377FD4E2AE2EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 49d23efd2ee7d2e2f8d48ce3ab8320bf2dcf17a0e948b2536d5c9fab33646a1a
MD5 466590dc87a16e54832c381c86d1ba57
SHA1 9c0ce973633771056c3977ed950ca49dd7c99eb6
SHA512 663f4fd33c73097b855b6bd45329dcbba80174c09a10bc04b176ae1d6edf0a2c0fb5b13aaab35868f8e1b0226b974937e4db8255105e32f6663f5e5e5b9a1abd
SSDEEP 12288:aQkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:aQkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T152C43341E9BB14D6F6044736234409E1A2D93CD7DD2AA30BB6A8D4E377FD4E1AE1AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a80a9b669e6d7c40d9571e2c0e5a64d77a2b25d7a9a77be34dc39700c3847e8d
MD5 c89a01f2616de984cdc18c6903bf9ef2
SHA1 9b2c63cf8c76ea0c9837101479827a5018bbd44c
SHA512 b5a54f2ab88daea836c5e4626e0f42939752f7141210870f31d14719f09250ec4599fd453f7a7c5eda9f5245e62657b376231446c03dac7d14ec7edab393b9d3
SSDEEP 24576:JZMRzFVSOIkzhvrJ2RRaPYHZ1INzRDWF:JZMRzf0SvrJ2RIg5uNA
TLSH
T19E050195B3A018F8EC67823E89158942E2F27C5A0B70C61F03A476676F773A11D3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 90c227d8c3abb576f0195298de1570801fe4b6e4e55de941beab9749d169ff45
MD5 f9b09acc1a588f06dc3c279707db3eb9
SHA1 a761a1fec12af225589f0dd6cada8681a50c93f1
SHA512 8f8e5c869a27d71343a8b3157329bd80973d2bfe84c46ffecdd0716554673c8e6cb647dcb128088e08dd1eb94f6fd145c31e977c2ae1266f1e7f9f28369f11be
SSDEEP 12288:QdkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:QdkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T141C43341E9BB14D5F6440736224409D1A2D93CD7ED26B30BE698D4E377FD4E2AE2EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 637846c8364ca496824dff5de739a81c3001f9ff1a2abdca61f01e7c9ab221ee
MD5 07cb2e9d4712f8887d85a33487aeff15
SHA1 80526c020c28da8d9d196eaa5c42c4d6e592666d
SHA512 e8940348cfa64ff39f4c7a15cfb19218f484e25c868324c0728104d7eda41c8dee4a98b1649234f45a996a483b41beaa55af5fe318f2fcd87fbba8ef4722c921
SSDEEP 12288:sRkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:sRkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T161C43341E9BB14D6F6040736234409D1A2D97CD7ED26B30BA6A8D4E377FD4E2AE1EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7b6b915398e4007e0a2bf9a984c069fbae1ae0e4845d141d88d8e95de370b3d6
MD5 5c00b5db049abf7795d1255de398a2d8
SHA1 3d86c3598ea5c09991dca64766c3f88790234901
SHA512 c192e84c4afa3f69b4e2cb71013d2409d71270255506fcfd1d8ad4cfe5769341dd012f7078c5c830e6c428c99b52dd1508fb4fdd080c0ff24b0f4e886a6d36d7
SSDEEP 12288:6yPz5L8ckbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:nzyckzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1B7F4124773B530F9E126823989510A42F3B278724B209B9F53A486B73F675D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 f285e22da1e0b19b08b641cf728bc9c81acd4e50cf1be98f302b69d59ec3b7e5
MD5 7d9625f28abaa3cee829128d33716f12
SHA1 e5e3f3ccabe01cd15f45a15924f8c7e1b7c8c341
SHA512 5444c4c3ac7014fd0fbf11abfb492a5f966f70ca9f3c455431d58bf3d0f752345ae4d1c76660923a61ca1b233f279f7a6e136250506d0fec3f41c89d3f769adb
SSDEEP 12288:ddkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:ddkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T18BC43341E9BB14D5F6040736224409D1A2D97CD7ED26B30BE698E4E377FD4E2AE2EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 db67c52e07ea10ee9a6614365d67e2d1266ea9790e0fb3edada5ba09d6251857
MD5 5eaa7c2514085855631038e5537775d2
SHA1 4278b04adf381aff13afcddc11c8d704f1f6394f
SHA512 ea78cd906d75713ab71ac1e8883a5faad04c6ccb3f6ecee47931dea60ee4aeed367dfb372777ab505f7104e0d677fb8469ecc1ceae96e1c058651aa85f3d5a81
SSDEEP 12288:ZdkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:ZdkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1F2C43341E9BB14D5F6440B3632440DD1A2D93CD7DD26B30BA698D4E377FD4E2AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 bf8136a90befc645e613ca0d9c704a26c2dcadce336a6b69268a19ac75fa0db4
MD5 e39d5abd7740ad6dc74eea2208db23e5
SHA1 2a835e0641c0d9df0bd10c73e9f63cd32d720437
SHA512 9a9b93c054cd1ce3404d7a000d54f48e85f8221a68fb114e2a1eb869d09c7fb440cec227c4ebe08aed2ee5e52b7891fd5ce8fedd0092b78c163b2afde8e89c1e
SSDEEP 12288:XyPz5L8ckbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:azyckzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1EAF4124773B530F9E126823989510A42F3B278724B209B9F53A486B73F675D19E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 a86276563b9d3cc523d5c533d91e3462188ad0ccbb963360df79d7151597cd88
MD5 33cb925174fb56aae3d56b5eafbad73a
SHA1 1fdfe10f18b4a5caff9e3fd17484f9c7496db1c1
SHA512 86b83dc39b78e12353a8e6436d9abd6425bf4ae1fcc223d47958be1b82111c894890d2c7b06d0562c4aeaf63a2066436578d4beaf7f4f126ab92e82524a3933a
SSDEEP 24576:qTDaLl3z0zDikzhvrJ2RRaPYHZ1INzRDWF:qTuLljPSvrJ2RIg5uNA
TLSH
T1B4050194B3A018F8EC67823EC9158942D2F27C5A0B70C71F03A876676F772A15D2EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1dc181ca88d6e54e2b8e0d02216e0ef101cf23761368f4e4271d8ee0b3ba300c
MD5 23558ad8308d962814e52dd852f928e8
SHA1 be06f942dd37a5e8153235dab82c371bdaaf5863
SHA512 393ef170ee31e7cd1f91d8d4f43cbc464c9ca5b97e7f5aa80bcc03afb25a9debb6852701b49904f06944ba365bc1281b80767d6f737717d0d24ece3c68f42735
SSDEEP 24576:g3vd9CHKy7GZukzhvrJ2RRaPYHZ1INzRDWF:qvd9CHKya0SvrJ2RIg5uNA
TLSH
T19325DF90F3E410E8F0B78A358D764511DAB67C9A5B31DE8F03A4655A2F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 52d91ff2f120b0143e405184ecc1afd615428c565e547264e357d57c8b99724c
MD5 05e3dbfd7aa57b1617cd091053a8600e
SHA1 8426de3317e3a034618203a03e346b8879a67cc8
SHA512 4e113aa11f6371be4b1c73d34895ad9ee8522ba0bc4c1c35ccb8b3955779e69da197299c0e8b0b3c2f688ccb2f0fe08c4dc54c294c8eb4458abf1b7eee8e7545
SSDEEP 12288:2SkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:2SkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T197C43341E9BF14D5F6040B36324409D1A2D93CD7DD26A30FA698E4E377FD4E1AE2AE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 250cf2b0989a937a7e163df704471029f27608ee0a6d2498594c369ac286f387
MD5 fcda9ef2db3d2e62da7663b9d788f277
SHA1 6070db76404c5f685d760e8d9c2430d688dc80a2
SHA512 8939d3e54aa011f1510a789b47847e9a3383fac3babd4195891a1b7e33525702d46004f530440e2ac4ee915e8e19c532d80a7a38ef2888de16ba183d5a268492
SSDEEP 12288:HbsfNkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:aNkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T10CE4F149D2A801E8D06E6239C7454A81F3737C6587E1D3CB52D0F57E2FBA5909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 e7d861641054888564e0734a80802f9f224162c4b37c1845859fbfbe5dfd7d1d
MD5 5cddcba3e1161f6d66afe808d6b6fbf8
SHA1 a1afc9534e1e8043a9a5d8e090fb2a3088b22efc
SHA512 0a131491f136b630510ba03ba16b95ce5de338cf9d7cee5509167f0962b8df08fc16fdff869be8a2745e39c2bfd15fd4ad91dd27d263e31299f7baf0ad1eaa08
SSDEEP 12288:7tBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:7bkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T19FD42341D7BE54D5FAA91B31224849A1629E78E58F24E3CBE140E4E376FD8D1EE39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 262d75df488efe46041a444c1ff74e409fed2bc67e29cd4070d247aa30492004
MD5 ded7b75f7be6fa9e308c27d30ed2a57d
SHA1 44addad8563dadc7fd34b6f6f021053d5d31dee7
SHA512 d286e6a12cd62e97a80fb0401ae9122f772f8e22a46b32e784089c33b23e591aee6b691dcfd2cbb82288b957c8b54176566a4a121a79dd009f34ba54c40d6809
SSDEEP 24576:G8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC5kzhvrJ2RRaPYHZ1INzRDWF:/RZwQCyiHiQEaaPnMYSvrJ2RIg5uNA
TLSH
T14B85B01E62DC46A5E0BAD278CDA74407E6B278164731A7CF1190C27D2F27DF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 5818882806bdf7f9d9f5095786dac75d2c6300176613f47fc3d42fa5391445f4
MD5 53c9e64c7b70ac1b271720891f7791c1
SHA1 7dde8ff9b1989da314cdde34c7c78f42d9655c00
SHA512 e429210b6f129d98cd03f1eb0e2fa5b208151c2a00c337cc8230d20e485f51b4891e9c4f665e49693001ce54840c18c71ca1678a86b0f98202ca669bdca433e7
SSDEEP 12288:TbxA1U7KekbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:TbxA1UGekzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1E2E4121EA6BC24E0F175963D59818142D3727C665B21A3DF20D0C2BA2F7BEE49D3AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a66d568586bf0dc9183ceb1c9644fe84a64c939e4baba835495ec91a84bfabc6
MD5 7aaf117ef1914c2e4690a8eb7ae2112e
SHA1 cfbadc79cb4e621475663a3089052e1681f648bf
SHA512 55abd965958fc9edd580d789f3c3d22ee0070cecaef6b485726ee30af92f92ea634d0e61b6bd50747ccc1015ace2d5d301f294f6b5bedce576430b15008209ff
SSDEEP 24576:GjsmP0yHaqrVqHra44KDzMsrnHkzhvrJ2RRaPYHZ1INzRDWF:GjRP0yHfVqzlAsrnHSvrJ2RIg5uNA
TLSH
T13245AF2EF2B910F9D4AAD236454107B5BB71782D1F209ACB0170C635AF0AEE89F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 7f536eddaa100b6659150116cb05ce648a2f1c347c6849b46152a62c681a9da2
MD5 37775b6478dec158419702f498f2acaa
SHA1 af4bfcbc4685ca1d2a966bd78031364b09603f1c
SHA512 dc3c424c96f8f931d05ce2f9a1cc2640ead80025ad81c72d45c2bfbec1034705f2471de124b02cf831466afd1e33c870532c7e682867be16d16f03fd5490d0c3
SSDEEP 12288:aHBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:ahkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1F1D43381E67A54D5FA444B36224409D173D93CD28F36A3CBA094E4E377ED4E6EE3AE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 0cbbed2248304b215a90ada2226ae76bef9589a1cb6efdcbe248c62d7e94b1ec
MD5 73b2dc70b04030bfceb3ad444f19b24e
SHA1 b5aca14c7cecf9c55ce0fab9cee340b1b45d6317
SHA512 991fe0e57ac65620633cf1610d48bf4fe2092f47f4c6257875b4e7dbf2287d2993040ffddbc8cc40a23d37206b1b1b98b0ff7f13f171c83bedf79e4b1797ff04
SSDEEP 12288:JObfA4LWO+vAYFTpBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:+bLBUTXkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T124250245F7A500F9E967C23CC5668912E3B2789D0764E7DF03A88A662F537E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 2eb7246e153db30cc3502c7d079a1e0eb2e40d99c49cdba8e71a43af8cf37d16
MD5 f8941807a188946cca711caaef35ab53
SHA1 1554ebe5d23a2e916017a98ee89efcbef162fd93
SHA512 05667a20fa753b3c9fd90e06e665a8073b0b83019cd0b904520ebbc2ebeacafe6443d73b0224a791d29e32252be5a8bba8b0e478f805c2e430e635d7ffa30aa0
SSDEEP 12288:l70Vm9IYNvUyBpcBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:CpYNHukzhvrJ2RRaPYHZ1INzRDWF
TLSH
T14A05F11EA2AD08E4E57B917D8AC28545F2737896171193CF01B0C2BA1F17EE9BD3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 77f874fc227af81f1ffe6c777bef8fa5b7e3c73800a58d33ef5c2f5b7f5402a6
MD5 ae26aab3625d34c38193241ee0e368cd
SHA1 1b1cfd588c41b76cadc5c2f3728ccb43ea63018b
SHA512 26dbb96f087dd037f849f322d764d376dd67b02e58393141cb47ab7ba748f1c36aaf70160e25e6e3e7630462c57a7b1cd1f2a57753b81e8de1744c65b25ef46e
SSDEEP 24576:NnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKL:NnXoJJYH84VVS6AmEOJas+cHBjSSKHP7
TLSH
T19F65AF5EA2BC04E8D5BBD17DC5824506F5B178661331C6CF0260C2BA7F27AF5AE39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 234b0c2fe52fc4e44576d46b8f8dc48afa872f81e742689335c6fd11680eccf3
MD5 f37729ea4df1d3b684b9fd7668ab2f82
SHA1 689ccf56f825fbb9a79ac8f4e6e06d0025fb4d14
SHA512 8f2699fbfebb954ed7d8e2bdda83173d8b883c70dd7a47bcb63fb085b178b3651820f27846168a653701f7d8151c78c357d0b3594b540e08dbfce84d6da68ebb
SSDEEP 24576:uv7Xbxd9Tuycf8M/TYlSuxwr2PCckzhvrJ2RRaPYHZ1INzRDWF:uDLL9TuJ0M/TYW2PBSvrJ2RIg5uNA
TLSH
T136858D5EA3EC42D8E47BD6BD85A79146FAB2B895173081CF0290856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 adbbadc71162eb977b05e3670e9a4a79587b27f61b966695579ed30684532a95
MD5 7e6ca582c41a516059de0c347255657e
SHA1 b8179788d48c5a1307ebfa5f584638fdb53c5783
SHA512 963cdd991d5deb0c1673c07ef7a0c7cc527e4b10fe48c28c9296e0bcc2c6f4dcbb6100756eeac709b31d7df50b14d2b47a406c481f8144cb2fa219e3b706eca7
SSDEEP 24576:0egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wXkzhvrJ2RRaPYHZ1INzRDWF:0ngOJOmPOHzXSvrJ2RIg5uNA
TLSH
T1B355CF3FA7BC15D5E03EC17D8A968916F6B1786603255ACF0160827E5F1BEE46E3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 e627c7b0f0e4fc20e842960bb3e906c6c92c5eacd8e099cb8946b087668d3588
MD5 2f9a9bae1a6786fdf8e7b2032bfebd4a
SHA1 791d4f0c132ed8be166ffab0f9bc0965ac346db5
SHA512 af88d26c20be23a0adc1d2ab0f31b4d62cc58e0cb873e2bdb9bc4883af8000eb9373d51206b1d9c892f5ab54ec0bb8ab7707dbd91fac54cee1dce63d1647d4c4
SSDEEP 24576:mLJnJiTk3R3waE4JrOBkzhvrJ2RRaPYHZ1INzRDWF:mLJnJK8R304lySvrJ2RIg5uNA
TLSH
T1ED15D12DD2A810E8D4B7C2B4815A1B96FF71347D2F256ACB59B4D4313F12EE0AA79F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b0e2979a32ca6ddd581e0d5ff7845fc6c07c63f2aedc3f7968fb4f3be1eaa6cb
MD5 12e4d128545bb7c00681bec4cea2e899
SHA1 9a7cfed2eb969f85e3ed71c26d66deaea3f29409
SHA512 b01a5dc616f0a8dac265d97ebb08f00b5bf546f1da92212e866a9e33d898cb8a1adbe3d648bd96cd4def60be02319f4b428d0ee87af446e63e20e2d16a0639e1
SSDEEP 49152:79GqCzDScAZmlvTcFg8Ph6FSvrJ2RIg5uNA:fTTjgiA
TLSH
T178955C05F7EB5298E8B3CAF1C96294159B327C409B34F7DF4A80C96A1E32BD1D939B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 6eacdf60807f0ecb41bae6cbe60c696bb0ba96a23530042af4f99969b63979d1
MD5 2c53fab5e64fe8f0beabbcf3d1d84b69
SHA1 f6a5c195899ae50838896274bf8765bd0a08474f
SHA512 4363d8eab9e0741197b3060884e7a0abb39998a6053ee309c09763b2851cef982381fd857a5f9f895e9ae077d2c737b841b2d4b058012127a8d268117bfc3e18
SSDEEP 12288:rlYJeXm5nkEUuESkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:rlYJeXm5jUuESkzhvrJ2RRaPYHZ1INzs
TLSH
T164E4124D76BD30E4E12E823995914980E3B2B4B1571163EF51E0C1BB9FAB9E26E3DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 e1465975d6dec3e4ba215a26305d0c4fb24e0796a0172fb27559412f975978d9
MD5 6d192fe855aa39fbf3f562c2a95da719
SHA1 c1793112277cefe7645d831b8ba9c33aacc7e2c0
SHA512 5f3eb989422faf20841632afd0794ba58ab9797e0a61c339e04483e07e142108683fb44b95b32544c51b9668f2a54049f88bfff159a9df55bd56e5876f18ce7a
SSDEEP 12288:/wu6ky2BkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:/VtyCkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T199F41204A3B560D4FAA907389A6241D09BB5BC618F2193DF50D0E67F7FBA6D0AD35F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 becaba4071ab9f65aaa7b000a38289a97fe81014f256ef65fcbcf2d978aee9ec
MD5 41ea3a7f6163a5d36b9003ab64cf0439
SHA1 30c60077f631d97428cb81e962927dadcb510c8e
SHA512 7a3c884a90dd06114b2b7e14aedc77dc3f0561121477f9b6b8fee82dfed42dc40c7ad4a2360fed695ff942ad27fcdab5aaacc71ac2d60c646f4c75712e4484d7
SSDEEP 12288:VPpBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:pXkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T1C9D42349967A20D5FA054735221409D1A2E97CF19F2573AF60E0E4F3BBFE4D2AE36E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2ec558855add8800f844af4a63fbb0b04e52d0154af27a21c27b57b17835d26b
MD5 aaeb8c67d15771bba90a9445cea6be47
SHA1 fc0e17cb044755b8ffca5d619056da0408017a62
SHA512 9f9effacffcc8423b234248bdd90d4db405590652c25ce9174ddc9058a6c80fccdf0d6ee59ee87e4bf386e02ace87a02e5df07035cad18ad46a97c5b96a06a3d
SSDEEP 24576:ZC+TyQIu93VAumZr7jmAkzhvrJ2RRaPYHZ1INzRDWF:Z/TfIq+YASvrJ2RIg5uNA
TLSH
T11D558C1DA7F919CAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 971639b440bc2206075c49b71956669d03876c4b147f04e6988be9e5996208c9
MD5 1f72959f27c7b809784506c1e2966a6b
SHA1 3d04f4c256f775a9470c78d66eaad96e687bdae2
SHA512 572121b1339980ac5a120f2c2951057c6031a3e12b3ef43c6bf160655832890eabc34786ec76d2e50b506027c5187f879525b021449d553ee54695775120886a
SSDEEP 12288:XcyrWOstaa3kcslBkbRxHhPBhi8Jh0W8WJkdlRMLX/4fxxz241D8NzPpDWE5/S:uLQikZDkzhvrJ2RRaPYHZ1INzRDWF
TLSH
T14FF4F10EB3BE00E5E1A7823C88854152F6B37475571263DF42A0C77A5BAB5EABD38F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d0838981f1af9a74a1d1e64d312a2baf04c61f20d987d96183fa95e6909dc838
MD5 3110b2120381bd305ac7524ef0465758
SHA1 508319ac7bdd8293e8656d3a7fe97dec70fdd70e
SHA512 010ce30b655427cd0a9961b99fc5ca1071eddd9b408d02aa4525c7faea151eedb4e21defe1f5a8b91897e6d851206b253104f562fb2d4649bd5be6c8ae67ee96
SSDEEP 49152:9pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPCSvrJ2RIgB:+pC7b4+80GTkUTjgiA
TLSH
T140A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d14342cd930114ac8b9117219374a45f68a029c897e4d0629390c02225e61416
MD5 c9e689eb363817dfb05858a276575367
SHA1 aaf233a496fd3e6d9a4dbdbd032a5efd2300f539
SHA512 bb886bca45e87d0e452f6f48ae8d0341dc513d5864cb44f55d8cd1e9da5f029e37707afc094b654c085846e86bf0f7d6fc6e734fd19fe8373ee75792ffa84996
SSDEEP 24576:eSAwJPE1IDAo+4Kt+l4413JUQfkzhvrJ2RRaPYHZ1INzRDWF:eqPCIo4Kol4vQfSvrJ2RIg5uNA
TLSH
T1C955BF1AA7F956E4E17ACB749663C601FB727822133163CF9290C17E1F169E89E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-468-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-454-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-467-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-466-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-448-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-449-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-469-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-450-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-452-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-471-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-470-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-453-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-451-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-472-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-465-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-464-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-473-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-445-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-446-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-463-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-462-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-461-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-447-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-474-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-455-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-456-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-460-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-457-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-459-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1080-458-0x00000214E9240000-0x00000214E9250000-memory.dmp

Download

memory/1108-68-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1108-227-0x0000000000D40000-0x0000000000D9D000-memory.dmp

Download

memory/1108-228-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1108-61-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1108-62-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1188-332-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1188-440-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1200-430-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1200-320-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1464-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1464-441-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1780-331-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1780-257-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2376-0-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/2376-1-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/2376-35-0x0000000000400000-0x0000000000736000-memory.dmp

Download

memory/2376-6-0x0000000002690000-0x00000000026F7000-memory.dmp

Download

memory/2736-224-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2736-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2736-38-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2736-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2736-226-0x0000000000DE0000-0x0000000000E3D000-memory.dmp

Download

memory/2880-303-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3172-431-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3172-301-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3224-72-0x0000000001530000-0x00000000018A8000-memory.dmp

Download

memory/3224-70-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3224-73-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3224-56-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3224-50-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/3224-49-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3272-442-0x000001A46CEA0000-0x000001A46CEFD000-memory.dmp

Download

memory/3336-341-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3336-443-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3972-340-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3972-279-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/3972-283-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3972-274-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/4024-323-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4024-326-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4560-352-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4560-285-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4620-309-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4620-429-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4620-317-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4620-315-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4620-435-0x0000000000E40000-0x0000000000E9D000-memory.dmp

Download

memory/4648-328-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4648-436-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4820-335-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4820-433-0x0000000000C30000-0x0000000000C8D000-memory.dmp

Download

memory/4820-267-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4820-270-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/4820-261-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4944-434-0x0000000000C40000-0x0000000000C9D000-memory.dmp

Download

memory/4944-426-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4944-299-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4944-293-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4944-302-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5060-223-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5060-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5076-225-0x0000000000C80000-0x0000000000CDD000-memory.dmp

Download

memory/5076-21-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5076-24-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5076-15-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5360-422-0x000000000A580000-0x000000000A588000-memory.dmp

Download

memory/5360-344-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5360-353-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5360-444-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5360-439-0x0000000000DF0000-0x0000000000E4D000-memory.dmp

Download

memory/5360-390-0x0000000001C90000-0x0000000001CA0000-memory.dmp

Download

memory/5360-406-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/5360-350-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/5824-28-0x0000000000730000-0x0000000000AA8000-memory.dmp

Download

memory/5824-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5824-27-0x0000000140000000-0x0000000140136000-memory.dmp

Download