5c699ff676cf875395f100e75c7a2d5fbcea3191d309ee386808b599e674dd3f

Analysis

max time kernel
149s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Size 5.5MB
Sample260511-d78e5aes4q
SHA256 5c699ff676cf875395f100e75c7a2d5fbcea3191d309ee386808b599e674dd3f
MD5 5ee1a8c1db0b6754e5800c150ec236ac
SHA1 26b0a5724b6f508b284e63f7bcbdf67b28d399a7
SHA512 a79a1d35edad2140f0b2770ecd8b33a6adecbeff7a63f896886bd83b19563a8eabd6c1ebd473eb5f78e505a8fe3c7f65aa93cf627c0039811ad47d382cd96f25
SSDEEP 98304:dtX28DwStyL/owSpO27bMz49JOrLhPGnxXjqpP4ox+X7BrWc8WboBhfJ4k:dw8DbyL/vmO27bMseymbjc8mKfJ4
TLSH
T1F946BF217641C172E99201B1A67CABFE497DA9311B2A54CBF3D41F6E19306C23F3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3912	alg.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
1052	elevation_service.exe
2964	elevation_service.exe
3240	maintenanceservice.exe
3916	OSE.EXE
4524	fxssvc.exe
1532	msdtc.exe
1312	PerceptionSimulationService.exe
2628	perfhost.exe
2348	locator.exe
4968	SensorDataService.exe
4556	snmptrap.exe
4704	spectrum.exe
912	ssh-agent.exe
3140	TieringEngineService.exe
3240	AgentService.exe
2900	vds.exe
2916	vssvc.exe
2528	wbengine.exe
1616	WmiApSrv.exe
1600	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7751238989fac755.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef9c9c17f8e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2d89717f8e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003cba7c18f8e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c94cad17f8e0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003beff318f8e0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2040	DiagnosticsHub.StandardCollector.Service.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
2040	DiagnosticsHub.StandardCollector.Service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe
1052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2236	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Token: SeDebugPrivilege	2040	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1052	elevation_service.exe
Token: SeAuditPrivilege	4524	fxssvc.exe
Token: SeRestorePrivilege	3140	TieringEngineService.exe
Token: SeManageVolumePrivilege	3140	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3240	AgentService.exe
Token: SeBackupPrivilege	2916	vssvc.exe
Token: SeRestorePrivilege	2916	vssvc.exe
Token: SeAuditPrivilege	2916	vssvc.exe
Token: SeBackupPrivilege	2528	wbengine.exe
Token: SeRestorePrivilege	2528	wbengine.exe
Token: SeSecurityPrivilege	2528	wbengine.exe
Token: 33	1600	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1600	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1600	SearchIndexer.exe
Token: SeDebugPrivilege	1052	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2236	2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2776	1600	SearchIndexer.exe	105
PID 1600 wrote to memory of 2408	1600	SearchIndexer.exe	106
PID 1600 wrote to memory of 1596	1600	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5ee1a8c1db0b6754e5800c150ec236ac_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2236

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3912

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2964

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3596

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2348

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4968

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3428

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2776
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2824 2828 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2408
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2868 2864 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b5b416e972b64b820bf230827e98afa058d1deaf8f7a120d1e78ccfeb2e73cd6
MD5 e320e230eeb56ae556dcadf4c8f7e67e
SHA1 876f87e4287327e35c0f8f7f2d5443019551e024
SHA512 b471ade90ceacd7935594952eec7626363e1edc233abe42ad35381d2fcc1f129d4ef68c64613df50cf3afc0a9b0a87cb6de18cd99da8a023fc420f05bcb3790d
SSDEEP 49152:Hb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnyfJ4klKXnD:13q6mjBhfJ4k
TLSH
T165D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 adca24d033836fbcc1e2f7181cd446c29032ac1ecfb89224da7432e9e2603e51
MD5 fbcde101216d962005b73a8c63a7eaff
SHA1 0f0ebc4e762691593bc143642f6ca0570318b7f3
SHA512 7e093c8a306e9657e16f6790adde7cdcca7832b29f50171e58e75cb2f6413c0806c2716f27051ce742a75863d06f3c24a7f883feb730d3584088889e9eb9db59
SSDEEP 12288:J1XLsswWkxy2lRq2czAlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:HXYfDtczAlfJ4yL/tNCJPXUQrPM
TLSH
T15405F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7517e5dd38e1dd48de2338ab4620528622fa45bc93f5658519d2ccf903c54b77
MD5 a454c156df2e9d6a6a7851e61a0ee644
SHA1 dcf2088f6fae67b70cfb19dff7bf6bc6d3f31654
SHA512 bcafcd59feac585c6d3d5d5817410622c9b5e93378f696acd6e5750d0260082c4b4540880a5a703656fc401d42595c0df90bd582e340aaf62a46d4c58408d236
SSDEEP 24576:S0Le5ji0hmxhrMafJ4yL/tNCJPXUQrPv:SPji0AzXfJ4klKXnX
TLSH
T1F535AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1562e04b5945fd6c9f97cff0d9155c95bd91166a4d7bd3d9eff5a85b074ac6bd
MD5 3ab41af075cdfc249743be1cd0eeacc9
SHA1 c794443b26bd85c64c4202af8e6cdf0f31543325
SHA512 90b58ab64ff5c7f7a5fe47c50e6b93a82d56738c3f747748e0152b289f11fcf1993d3b2a734a4ea32b2dca322051dcd85b720bdc3e912600baa62b4fb396e803
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyuQfJ4yL/tNCJPXUQrPu:0/ezSC6vUzPv+Hjy7fJ4klKXnm
TLSH
T129756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 03d319252781cc3223c5f41c9ffe9fbfc5d9eeffcc12359d00d37e2cdaceefc1
MD5 f8165207578ffb0b4002fbdbd855d5e8
SHA1 484440e05e6c79158fe1783a4f7207ffe1708fd4
SHA512 912b1a7d0af9e7414f8f61e0b415451d3616bc5a56a3be2662438f224d227de316545b2e10946dd2e370ddc5795c95ccab513cd43cb96ba802b2b5b31d04c557
SSDEEP 24576:uVbqPb88hv/l+BRfJ4yL/tNCJPXUQrPR:uVO88hXl+3fJ4klKXnZ
TLSH
T1EF559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 66af69bffe9b858e03980f3ff65156c6c876b2077d5cfbf658062d937c54582f
MD5 556f4a9e2a5b1d7eb9aff491586a4829
SHA1 5c33925ecdf55f3ec88768be308ac8ed0ce5c2b3
SHA512 fa8acc9065f734af6488495fdde5616cfe15727bc9b8e331269b43dee71c0608b6e7b0494ae8a80efeebaa8f110f23e1ae16549f3d62d2a51efc8f658d904f52
SSDEEP 12288:gGWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:gGWfJ4yL/tNCJPXUQrPk
TLSH
T10FC423E751809485DF6687F82A88F001C714BEC5162FA2F6DE42B8867FFC91A559C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 2be0ef6d94bebc3b55c149187662b1e53931e452fcfc143336ec140c1f032946
MD5 88aecaf5d5ed08da5f154cb05c9f2baa
SHA1 15cc9f61d2fd81d1dda1ae975a096eea66966996
SHA512 85d6919bd5ced91036887effefffefe0a82d906793b81d5a6a7fb629560b1da6958a2fbf80ac43feab500de175460d93026dc8f1f5400d5e3b0c4a3d8028673c
SSDEEP 12288:MeBNUbTVO86U5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:MJIU5fJ4yL/tNCJPXUQrP8
TLSH
T10105C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 30a6481119c34d9028b4371454a9116c8d4ec7b1635abcf1087449663f9ef21e
MD5 1fb60d30406b9f5d428e6fbe26b3d733
SHA1 e64a3a995792fa5b657906ce4b681a89937a0d63
SHA512 703089471f5c3863ca4d4518b209d9376472b4e9b3cab38323d860feee4be0b322a76cb71bca81cbcd31a7f9946508e8010e0bbe1a93c855dbbefb8a0bc1412b
SSDEEP 49152:7QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THi:7QvGAdlCEL8c/WRNw5CAfJ4k
TLSH
T105266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4c5c365c852a8d041df9bf69a72381ac6f52e03de628ae01d3246ed2317f3797
MD5 5006e3a13bfb0a3fe6eb82238487acb8
SHA1 a66b9c15352bd4fbd8caf012d2b560c2b4c6d67a
SHA512 d4289397c87dde2e720a556a22d6503a2f280aaf1431f29ed46f360a7a25d6a3de2b83f11e4bbd071b7d5dbb5420e67be4da91d1325f0e42b959c50c9df7353f
SSDEEP 12288:uAwSfxL/2Dc3mDLLmt0LDQewsAjHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW2:TfewsAjHfJ4yL/tNCJPXUQrPY
TLSH
T12E15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f29c02642302c0af89dc3b2fbe09ad79ae54ae64a4046db901141a8c9ffbd538
MD5 568c1c79a5d909055a2bf91c8a42bea8
SHA1 7721f17c3f2f516525c4a21ca8b523c106357b2f
SHA512 eb088e31feecc5a3458443710084eb6cdcc4441a3238b284db24fe89abd13d03e23aca47211953d2c5bc357148ece0184258d19cea0aafaa314269b08e00d79d
SSDEEP 196608:SUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHffJ4:SUEtQevvqc2W1cpV20I32f
TLSH
T157474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 13f22d3a36c969ae66aa7ca78d01dfc96531346e7d7d673f031fe0749a4745f7
MD5 b345681dce09bf2df87433ed9841d106
SHA1 eac10fd46de4cce96fff1a10011908a1361149e4
SHA512 a1d12220268942b6487abf62015625658bda022ac5b381a70d21c11c9d35707d177e661f3029e5e80f1abbd26233aa0c3983bba7557edf7100e4889ed5933875
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/znfJ4klKXnM:5oqtVjnmUfJ4k
TLSH
T1EBD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d2affa4e7b77704dacff244dc9a722fcdf41733336858ab411f50ecefc25a204
MD5 ec7ce84cc6d0af4b4984e3da4ffc26a1
SHA1 d9282a5aa4ce347fa205b96902131226515fdd7c
SHA512 8109b6179a3261f2393ff5eca1ddee7e69fa010b8098e0f730239b319bc37ab931b90e705266578d0bc6e0e9fdeba179f15d4bbac0e098581242c1171e56a597
SSDEEP 24576:3AhGL6IFoiwtA5l7S530fJ4yL/tNCJPXUQrPJ:3AM5Foiq5EfJ4klKXnB
TLSH
T143359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 0357bbfa8f405d3ad556f00fa7c776b120cb65fc4d4db9ff75f7b2f44fe27f8d
MD5 c58caff37ee949cdc128535869bfe386
SHA1 c11146b4b184d90dbe1133805aeb5f8567d6abb7
SHA512 e51b2d03c8b737630d4c9cafd531037306ed585b242cfe875123876ec0885fd734c35b3844e9215656823c277a6d5d89181f48b20f22e2bb39eb3aaa055e2b60
SSDEEP 12288:1mw5HEjsChNEBFgl0WDm+CwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTx:wwuROWbfJ4yL/tNCJPXUQrPV
TLSH
T1AC05F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7615b2ff5c9138d6e210fb895ad48e3cfe10613ec6e23eab56b165b8b09a7584
MD5 ec7cece5d312426001ad8db9757ac3d8
SHA1 bc742bc6923276f807993d1b227f475421ac2948
SHA512 c83a13bbca4c04b9fd027307b5661f09d21ac8fef97a22a4c2495b56b716034dd4e7ff488fcd0f39b4e6b5e7e7ade82b952d29acc8fd7827029e45026920dcc5
SSDEEP 12288:8yZ1Iy3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:BZuifJ4yL/tNCJPXUQrPG
TLSH
T14EE4129B32D460F9DAA782BC8AD4D101D3317C92273A43CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c0c7ec9983e42dcca5b6ca7da94c83323d42a13943c3e8084cf3e4d3139f8d2c
MD5 778ea3e6c862246f9344eeb5de995efc
SHA1 6ed2d1896c122f07d55925711459f284b6a324d3
SHA512 18a76817c5fa4dfe143cc63fef5ba9e5c1ba2f4a96ee8383c8afd45d7b0e2a2143080a8e91ca9a22779dfd6d65e4baa8277ae8a5b4ad7fc929875a52afaa1fab
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uh:8QRQyi36YOcPDLvw2gAf+PN3tfJ4k
TLSH
T11F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2b345e527584aa3f9b7ed3c88f931f75c16f1a26d9b2528b602be69747fb0ab6
MD5 0e5d5edda810cc766231b51ce0fc58fa
SHA1 6b200b1eb10a9a34e35b8fde814d01638909be4a
SHA512 b4a88d26f9ddbb2c1ad07150a1651322a41c281bf4540d63a0b301d571dd547c55fad30d32f59ab079815cf2b0e01a406d455cfe95c57e73d9c0aa39a4028485
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UF:CQRQyi36YOcPDLvw2gAf+PN3tfJ4k
TLSH
T18F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9cc011f2b7a71cb09b0afdc51de4870bcb352c994b75dc0aebb9fe73b8ed456a
MD5 cd0f0b3ff47446ff14f95b23f62f5239
SHA1 ffffbbf49454a37580f72a1582c36b325d4ac44c
SHA512 1a75f0dc0e0231945594966548d16aa6cf5b41944d23d04af706c73c9d7fc549b60132c573a0e65ab944612c43b4a8808351378705ed676b21bf6527fbc44c13
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0yfJ4yL/tNCJPXUh:R68Qg55nhkeWu7PNU3/XfJ4klKXn2
TLSH
T18BB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d838bba3a6e195786a92237bd4389414e5e9d3f2edd3274026ec38d23e9fdd3d
MD5 9ddb41402c74aff5bb1400309277b873
SHA1 28441b97457ae8e04586869a32f83e50a234faff
SHA512 ede28a8f642d9b42be4c907381ff25d4148235fe4e093666345efd4e42eaa8ac540aa8967d735c6e29f9948332882cc94d4e5f43ab31f798e5758c91438667d4
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99G:ky5112gYy5azzVvU69nLKnhZWfJ4k
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e2384aba581ccc6b766e47aeda5279a10ea92652a84ed4e67dd5177e27002f7
MD5 e7e460165876dc7ae713e4930c88a4cf
SHA1 33b7e29a3c67deb1781d47d0417299e37d263d80
SHA512 402414d61c6d82249a113fdf422984377a40af0a96274be811f7236f39730c8e87146b9a54188ca3eb849997dd1080e462c09606ee19d0043125dfd8a660dd29
SSDEEP 49152:2B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1fJ4klKXnx:Eu6JmIxd2d1fJ4k
TLSH
T142D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e31fb106b019cabf1d94486f0c6693e75999da85510ced8fc3f259554033bf8
MD5 cbed6d634a8780394b19963aa844c1ab
SHA1 5e8cb77aa4b2d0d758ab97d1276ebfc53d5b8854
SHA512 fcc6a393a6da4dbc8b32cd255d628f1e0d137b4579b58d824ee0c4654fdd70d854b4eb2db1481cc9638765c1e61243c87f5ef934d5b93a23e5ff9b51c3bd3bec
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4xZfJ4klKXn2:bmifPqRUfJ4k
TLSH
T1E0B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d5ba86ebab40f7e53508ce7c66aed3e50bb8782f7d5a1963a7b9b6a9347177ae
MD5 50fe675de445252a01187eca578b865b
SHA1 33610ee2b37fa0b3af50d64c40744a8587137aeb
SHA512 311211ecbe449bf8b6e212dff1423a16ffaebf3206d8b484937b52231c1b7177249fcbebf3f1a20562422a6f8c81c3248893ffdc670be89c1911d4c588cfa1a4
SSDEEP 49152:6SuZQIY0Be2KkRVtOnks6NMHqifJ4klKXnk:k5dKqi61ifJ4k
TLSH
T144C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a1409aa11f5653e153851e9647dd37256777da1f7da339df847fed083fd69dd1
MD5 dc55348b7906f912d203620dcc73937b
SHA1 846565d9b200dea320a35e6c32912b49889308cf
SHA512 3ff7f6db631288901d5dc6177eefc9e1f94935a9050b2d8962bddf22f77d266fb83783b878b8bc69195d528458325f60251183060a430b6384c5f7cd338a1ab0
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5wlfJ4klKXnG:QX2iWph4fJ4k
TLSH
T1F195BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d325ba3cfef72e995ba3d098dfff4882714e681caa51fd5348901c59009ea251
MD5 6949673d088ed02e6a7c8eef6141580f
SHA1 fdd62540e4ef2c5897fa2f3df3a8f55c2ffb7159
SHA512 461ca0a3b7e5f32887b27361082d69b9ee3ca0a30617409ff2caa1f856f6911a0c5c93bedc441cdc97098f4a45288c55ae5d3e7c9ce4c3ef9bb23f92c9f5b867
SSDEEP 12288:u+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:u+fJ4yL/tNCJPXUQrPR
TLSH
T117C423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7ad8a6b5ca70b8fd42aa6c7c0e2069d65790259e17c30dbe14e87a63b2778f42
MD5 e4b1453e39788166b9346f96e23300df
SHA1 968607ed2f7a479924fc4e436181282e49fac429
SHA512 43fe6062dc6ff37c36213139e28b31d92303bf8ee6f26913ac3b0976fb01559286c4094db6ac7f7572d43f76874e1e97efe88ddd44a92068dd92bd2498c33fec
SSDEEP 12288:AzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:AzfJ4yL/tNCJPXUQrPR
TLSH
T117C423AB60D5948ADE1587F81788E001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2950042ca23567bed6d487e283bb6046abf9d95c96194ca9ee9f3277f0e096dc
MD5 702ae974fa5340fd272e03b6adf967cf
SHA1 8549e9370e5a6c2b4fb6feb4550c90333a5ca9e3
SHA512 12b64f503354ef8f5c2b99c0b274775df634cc0f10b72270152096c0fe2374d2eba7648bd54f24f991b68cb8c96bc2ae5a6084f30658e4bbd94f9d777f7aecf9
SSDEEP 12288:nhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:nhfJ4yL/tNCJPXUQrPu
TLSH
T13AC423AB60D5948ADE5587F81788E000C3047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 83ae34bcd6c1865b600d59d18dd0caa166a2fd00000c97d8aadb13752a73d814
MD5 38270fa40ae8536f78dcd00e5e59274e
SHA1 ebb13a2ca9fccef524ea167f8858926c287ead02
SHA512 40d0741b62246bb04f59ee19bc2c7cbd1c0ca56c21806eec6cff555bd4dc7bfbbb34765dfe28804094a370224d9bb63d14208ed1719f1c8ddf395e5d211966ce
SSDEEP 12288:bVUfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sa:ifJ4yL/tNCJPXUQrPp
TLSH
T111D423A7219580C6DD66C3F84A44E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 6543a5ce726ec9a5857db2ad25e6070840d4a200929f0da0d4823ce764ba594c
MD5 2e78e4b438ff269643299f53f90f7ac1
SHA1 762e90ca733e3ac7e10d67405f77749b74e70c35
SHA512 501c286944b280be6dbb4fbb0d6e8d95a8d98ef6c030f901e4a837bbca1ad3d44da2cffccb096942ad7a94073e6d9d99b2433d2524a55c5df658b05907774ac9
SSDEEP 12288:zsfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:zsfJ4yL/tNCJPXUQrP7
TLSH
T19AC423AB60D5948ADE1587F81B88E001C7047EC6672F62F7EF82B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e520082df121989e7928cb317085de9ef07979c8ff5a78aa1b63f63354c16a06
MD5 50408f78d4bd3114a92af946036ad236
SHA1 71b4073c0763739ad58c79b48a0e985928a5b631
SHA512 523fe48a9d8946cc81947053c4f15e8ccdca4e3171fcce2b2ba872612a544df7a9b7ec4d2ee8f6da4342013021f69d23e08470d42edc363f92f55902419aa174
SSDEEP 12288:wPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:wPfJ4yL/tNCJPXUQrP7
TLSH
T129C423AB60D5948ADE1587F81B88E001C3047EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 2a8eeb0a3b55ced137c6d6a3b43ac6847102e4d48d06f9b3680236f3f7ef41db
MD5 d7b95d5a6fd381a0b9b1a9e1f5100717
SHA1 df580ad19b2ddb485728eb0a989d30bf05dbb9b4
SHA512 bb6d24c339cee5c5279c6cf920c12932d90bdd04d431862e7fb243aa321040fcb80929b13ba2276f2a5a4947eecfddbbec2ef0ee747f43bad9c40a5109e0b4d0
SSDEEP 12288:zrfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:zrfJ4yL/tNCJPXUQrPj
TLSH
T126C423AB60D5948ADE5587F81748E000C7047ECA672F62F7EF42B4827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 24869e7520b75ea0244bd64a400c8e34ab6fdf13a4a599a4f7a042e7abccfa3b
MD5 1fd9c60f5a09552e5ffc1aab766dd890
SHA1 5835ab313ad7e65ccbdc62175c9a9ff5aeb5ad7d
SHA512 dc6fc30994efa65b3361459be97ade4aa2b7b8cce5ac3caf7d2f94cf4a168f354d62d280fe58b91fd69a49ee05d21c5c8a8edaf72853a30c242cd8dc9d051151
SSDEEP 12288:3iZwbDzzFEoS2cPvyTfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:yZM3zFVSOTfJ4yL/tNCJPXUQrPJ
TLSH
T1430501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 4611f2c2babe152210c7e39a58b9e04ed1ddb37554b86e4334bca24b8b12a2dd
MD5 c5a9d581b7a416524b5f049fe23f13b7
SHA1 b03bd0b76839fd9d8f98352a5170b15f03759546
SHA512 88a6da741bdf723d6a061b4b76048c90cc16118869e627fd3db14ab6c830a53d8b6de8957d235ced9c943aab91835ad9062a47b4fdb81f0a69f21a5056aaae93
SSDEEP 12288:6SfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:6SfJ4yL/tNCJPXUQrPW
TLSH
T11CC423AB60D5948ADE1587F81748E000C7087ECA672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 eb643feab7cf38614e147491ffab3880d4fa97cf820c46485697e4ee872c1d27
MD5 b3e9b295bbf643f0ea18aca347e458df
SHA1 b1a928d3648e5f59203e798f1835fc2855dd017d
SHA512 c81c554051c80664ed2594803693630bb07569442eaa5c54eab3225ce0af752cab67b29332cd8c87c93b2d2d3e4b72f4025ed62fcf1e2d4f2b651371f01ef3d3
SSDEEP 12288:VGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:VGfJ4yL/tNCJPXUQrPW
TLSH
T143C423AB60D5948ADE1587F81748E001C7087EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 447871a7f8ca481e5c9d3bdf305753e8195aa13e91d5a81e360e113d42e8c79d
MD5 a1c0089a1dbbb67ba38a66a0c8fa03e3
SHA1 c5d4488a63340f5a7b7c445baed389212aa8ace2
SHA512 9e7de3c33cdce44caeb22f02ce0d8bd4ec962c10d39b8836c5f0332a3e9e837fbea815d979251b877d97c1533bec21cfb46efbf8dcea7185e6141a05575f5c8c
SSDEEP 12288:RyPz5L83fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:Azy3fJ4yL/tNCJPXUQrPc
TLSH
T19DF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0150f621ab256d0090d3a773749dd9760418254d6127c4d5202e24a8339ab67d
MD5 1903fb769a83571dcf30a76aa77f80f1
SHA1 91213dbef336e6a73c291a5b1cb5151955e357ad
SHA512 110b6e23c7f2767f315988caa879e0518de3f4306f22f8869be0ff2d0196f1544d108f41b97220a7a219abb0facc465f2f8fd16c0a3372a2b8211929f2dff8be
SSDEEP 12288:bSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:bSfJ4yL/tNCJPXUQrPW
TLSH
T1FDC423AB60D5948ADE5587F81748E000C7087EC6672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 b066375060fea4bb90a8988533df93c13690e869532a65c6b60c178391431ef8
MD5 3bfac8166e4fdf70fb23c539b672b8bb
SHA1 f3d133368278e6965b79fb136bc5b021a0512ea7
SHA512 88a9d80f7945428fe1f1f0593b7ea398ea703508f4a5110aa3f8b7cf0fd37749475de6e504dc7864c78fd684dd3501cd2ab8521183a59cf05076e041d3a9d982
SSDEEP 12288:fSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SE:fSfJ4yL/tNCJPXUQrPf
TLSH
T173C423AB60D1948ADE5587F81748E001C7087ECA672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 50acf1accef642252fdbf15ba02cc169078b99f8dcfd44413a9651ab48d5f806
MD5 87ecb15bf64df52bf4197bc4f24044f0
SHA1 cdb765714bd94f69cef199cd06277f34a8414b34
SHA512 ac49e8e9a5cccadac7e55d51a57593ab142357471a93afbbaf02a62b1cf321b3805136d6b10f162785c1eade94becd25c275939599199a9a854f1a33e93aa053
SSDEEP 12288:8yPz5L83fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:lzy3fJ4yL/tNCJPXUQrPR
TLSH
T1A5F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0cba8398f786e7e9b34cadf38dac80b8dc97322610b05b8c5684a9c0af18aed8
MD5 464b1b9e829f03dc5168f9d297c7edc4
SHA1 ddc771913f422ce0a127d6af27448a35d6c7f5c9
SHA512 5e8b001ee2f6066c130ecafc880200efd18dedfe32d60c8a78a631f461ea6c372e075518ef20aab7ce245183892b8ce096ecc2d96ed83c9a7afcc885fdf162f0
SSDEEP 12288:iCd91WYoaLHF3z0z04PDvhxfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTO:jT8aLl3z0zDxfJ4yL/tNCJPXUQrPq
TLSH
T1190501A5B39018F8EC67827EC9549502D3B27C9A0B70C26F07A436676F773611C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e2a2efa04b9a280e16bd366c8ca7b93fef1d79001c1f25d922392198a2839bed
MD5 03e87c0a5fd0ceb0652cbfc0808dba17
SHA1 6ceb2285f1c9f9afe923557e4067b111259c8712
SHA512 910bb1c5fbf8e2b5668611e46d08c67180c262d369c504a47c635edbe3206b524f04b3b2187d78084158554f95cf9054c02ef0f5b7c856e66116c95277450f02
SSDEEP 12288:wi4e7+RdTfgwCHKy7GLbbdIvofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGn:w3rd9CHKy7GZNfJ4yL/tNCJPXUQrPc
TLSH
T16125CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 918cdeeb9fa4357e41191f06f496644a465439fc027d8bd2f4f119b6fd9e0ec1
MD5 50ebc3a8f582be15edd16767b6bd55cd
SHA1 da1083a008a6f7c2fc9ef5ae31d1d1a91bba5768
SHA512 cc034b224d04faecc167aca4b0fbfbb04ea9aba44f6fadfafc96b694825095d00050273ff9cbc7ea512175f5c5cab40d103f8aa1074f3b1fbcedd199d24ca519
SSDEEP 12288:qBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sr:qBfJ4yL/tNCJPXUQrPg
TLSH
T18EC423AB60D5948ADE1587F81748E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 6d32e18eea07fc3371cdaa7ece536b81ef1dfe4ba2379039333a1d568f771d28
MD5 ece3d4e7daf091614f1db6feaf589d49
SHA1 c3888432f33d27b37f818e759637dfa3a02264fc
SHA512 b3a4f638da51a35ccae367167bf5e4ba138c7fc4fe0e220def4713d1aad4126bd35b8d9bc839d470c476b8702b893e9b025fbdfdc2d5afc32aae397a46fa12ab
SSDEEP 12288:jXfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:jXfJ4yL/tNCJPXUQrPk
TLSH
T183C423EB20D1949ADE1587F81688E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c28d50843d18f05928459886d61a67e62894fff1b72900828707f3911a48c133
MD5 3583a7dcfb2ba4c26e54399e84178959
SHA1 d0c08a6d03e9e7a0704f28d4ef2eff89aa8a70d9
SHA512 9b165d0dcbfc926969ade8295babefc96b3ce2f213331891191f4f2901c9cdfc8f4dbc5ba5087697b084a1c0d8c43c0df22144b3b2e0aee63f60c335c0af2762
SSDEEP 12288:ppsfifJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:KifJ4yL/tNCJPXUQrPB
TLSH
T1D3E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 193d1267f016668a79c1e19c7e2d36f50f9404a7a03bc870e3a5df3ad71a8249
MD5 e85ca8d41272f4bfa53c6b0f626dcf23
SHA1 1af7a5953ca34dea6c15583ed7fdd4929ca021b5
SHA512 ca0b25a06382b310609905ca4b9d75b0b4e31017a6a046b78cbf5381c373d80eea30b44ea9787a5545edfe7237e77eb2715376791056e3beef2701c8fc1d7a37
SSDEEP 12288:fIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:fIfJ4yL/tNCJPXUQrPW
TLSH
T199D423A751C89446DD7A87F8164CE000D308BED55B2BA2E7EE42B4853FFC99A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d8d394818d8139a072ee8f6028f91ed8c9ef8efe65b8fe31e84713ab84f91ca6
MD5 c64e24a32f929e86ebb4ede351503a13
SHA1 a2784e5cf1d6c0dbbabc89fc2a0c641462a63295
SHA512 fc35e9bc446547769a106dac337967f2a353d06b8442f9b05577169b616d8ff32b9b61cf71e15152258b80ca25d9fb6700752990e7d20b25f611658da609d223
SSDEEP 24576:U8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCWfJ4yL/tNCJPXUQrPT:dRZwQCyiHiQEaaPnMPfJ4klKXnb
TLSH
T19B85B01E62DC46A5E0BAD2B8CDA74407E6B27816573193CF0191C27D2F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 0f9b6d60a28545f7c2687b7aa940f8edc407327dc347b3d799e3dcc075619156
MD5 570a8395793fabbf43df8a5d72ec630e
SHA1 46321e7373168771242d63764c410dc60ad2aea4
SHA512 22e884dfffb673ae1dc07c96a19feaee2d9a479a30255081903215c500351d517a2efc51ae8bb4732978b7b345e209875d6c58ecb8865b73a12a6a4fdccc92b7
SSDEEP 12288:hbxA1U7KmfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:hbxA1UGmfJ4yL/tNCJPXUQrPa
TLSH
T1B0E4126F21DC24E5E576927C4A84C001C331BC962726A3EF65C1D17A2F7BEE91C39B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 efa6b824d11d99705de8f93caec314c35d276f17a78b30675d35d20b1f2b80d3
MD5 229dd93c480f9bc01a66fc9363f23304
SHA1 c4526f3957d20d54de75a9d679896b37fbe32435
SHA512 71a3eb8e0d567d131233e42101f57f8b37bda71789a761b1df74d32bf1d0139007ab16550d46f569b44aba2eca0c102b97b78d6df7f35dc5e34e9f69b97148a1
SSDEEP 24576:jjsmP0yHaqrVqHra44KDzMsrnJfJ4yL/tNCJPXUQrPV:jjRP0yHfVqzlAsrnJfJ4klKXnt
TLSH
T10445BF2EF2B910F9D8AAC176454143B5EB71782D1F219AC70170C634AF0AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 ce1619afa7108b4f044674064b2beb3dab536e0820e0935594a08545edb21b80
MD5 ed07a295671d81c57efd391393093b78
SHA1 62f4eb57a59a14022957e2a076f9f20ed0627605
SHA512 bdf485dd8f4b129f6866b04142d70c3fd20dc5dce207a098589d2ce63b2fa2efe821d749bd7a5a24b63d3985ae98fafcdfd621b72dc52c101cd6319e11ecc3c6
SSDEEP 12288:dOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SH:dOfJ4yL/tNCJPXUQrP4
TLSH
T12AD423EB60859486DE6687F81648E001D3047EC6272F63F7AD42B4827FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 5d8311f1751af39d97a5c71393e84e2010b67e6309a52a3f8fe78ecf98707e90
MD5 724f9d8eac5b417f7859f8307aa28eed
SHA1 2bb46d3cf981995091a0d8567013ad6a58e76d9c
SHA512 9018b14ac8259eef1be41645f248d351e2f6c0464b0d4fb8fd94d60b7bb7e0564ed648b121ae7a8d04393a4d5becd5efb96e6972ed928402b6231f3289a35563
SSDEEP 12288:NObIA4LWO+vAYFTEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:qALBUTEfJ4yL/tNCJPXUQrP2
TLSH
T11D250155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 5269af6f2f4007d4dadc76cc3e16b7697e0939e298c6c16f4487921b2a255449
MD5 735c8ea39f4378b5494900aae74547a3
SHA1 583fea5cce08b5a824fa4a4724d86f769567909a
SHA512 f67002f5d95f5bdb9576eef860fcf15c3481b0dc732686732cfd96bdf3c5567e8cadf8ff64058f84fabb42b1b62f511ac1d868db469e8443267531f069906a35
SSDEEP 12288:270VmzIYNvUyBp7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:nfYNHlfJ4yL/tNCJPXUQrPi
TLSH
T12C05F12F62AC08E5D93B927D8AC2C105F3727896171692DF05A0C2BA1F67EE97C3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b32e0975cf108721c262d5cfa0e5c2a47b5d4cfaabc8a9dc29bc773d97dbca90
MD5 e0472932724be04111e252ef2b6738cf
SHA1 0369d80efb0d0f0c59b2e3daca0e7fd11bb2980a
SHA512 11b5818cd950fe5050a4ffabf9e46212c7783e0268519836722264b9d5537e4c2765115302cff5a1bcdf74652ec0cbb6707076b23c6f0fc9dc7401e54866420b
SSDEEP 24576:wnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:wnXoJJYH84VVS6AmETJas+cHBjSSKHPn
TLSH
T18D65BFAEA2BC04D8D5BBD17CC5C29506F5B178621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 337ef7d6843ca1b640b2929b9d256b8f538fe9330478ffab846adb2717f1b19d
MD5 27d7ac74678a4bbae9d60b93dd0bdbce
SHA1 50f75efeccd29d3fba8e9d992e23fdfa7da84add
SHA512 4eaaf5cd81bd76a6e9d1fff7164e1a4f6ffb319e1dedd7e76a0b14afe2eb2a93dfcdd1e0d58da5ce0d63089962c7e376f6d6b9707d86bba679e07b3b18faaa65
SSDEEP 24576:Nv7Xbxd9Tuycf8M/TYlSuxwr2PCzfJ4yL/tNCJPXUQrPV:NDLL9TuJ0M/TYW2PufJ4klKXn9
TLSH
T150858D5EA2EC42D8E47BD6BD85B69047FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 d54da114b0d09cddf8bdd4e708e12eb82cc1873021ec01799e73678306b98dfb
MD5 37fcf9248384e6bda0687c4f665ef4a0
SHA1 e2105e9f2d2ef7f10d60fe0ff74f34eb7e003854
SHA512 84f2fe803961370111354b125ab1c7ebfd360cb353655a650e56cefaadb51de4703994531c8b51bc1484b2bb5d19710e0add8703b89b9f30e8bdecf7a1de1b39
SSDEEP 24576:vegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wEfJ4yL/tNCJPXUQrPT:vngOJOmPOHkEfJ4klKXnL
TLSH
T19755CF3FA7BC15D5E03EC17D8A968806F6B1786603265ACF0560827E5F1BEE42E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 db96504dd5ee84188983c4c7846536d588b4f70d52444d68b5867e0a7c494afb
MD5 ed70e23d57da75a5717376ad8db69f48
SHA1 c5f9ab12cc9599545bb05007ac530eab3341fde8
SHA512 0fd3d374642fe584b0d21f648b61ed48dd2e6d0a6392ea8c79cee93fb0dec0b0e4d63c42df048d8b5dd2a6b0c52422f1ca5a030fe9f7d2294447b3a6f5d8159a
SSDEEP 24576:4LJnJiTk3R3waE4JrOufJ4yL/tNCJPXUQrPQ:4LJnJK8R304lZfJ4klKXno
TLSH
T1BA15E03DD2E810E8D4B7C2B482596656FF31386C2B2669CB59B4D4313F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fa9f32cf35403ec8f42982c5a8d035e1bdac43cf41e168296cf34a9e437700f4
MD5 0aa2ef4623d3581a3542c8a26741ee16
SHA1 5b0af079c6673f8fe4476163072bd8357aed4ea7
SHA512 d3eb6b855ccf1bf44e662e56e526ee36b1399ad15e6ee9794a55578d762762e146af3bf50942ec129339511b5073dab93f23d42f7e5c84be74b13d63a0de21e8
SSDEEP 49152:m9GqCzDScAZmlvTcFg8Ph6CfJ4klKXnU:YFfJ4k
TLSH
T18E955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 c2955f4c3a320610d75ec668cf294bcf87249df7aaa80ed554501cd499ac618b
MD5 900b6481aba90c8d0e24a8c1685cf540
SHA1 b0e8092e4bc42008274d619770476392fe2ca873
SHA512 5e9069c10812ed159cb4f18220788553113f78b14f2b2fac82f3e548c6aff9ee0aadbc6471d23352124ea2242daa81822ca0e23c3ca3967d3f8fb652756ad1dd
SSDEEP 12288:+lYJeXm5nkEUuEafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:+lYJeXm5jUuEafJ4yL/tNCJPXUQrPF
TLSH
T1B0E4129E319C70E5D52A82BC5684C100D331F4E5271663FF96D0D1BA5FABAE62E3CB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 06d52171f51db92f5237895ec6f9231025543822b1c278c1532973470d0bbd92
MD5 b9605d556b9cde0829fb71903d183891
SHA1 17b6f7fb8fd4510ff9a71bf677a4437ca64a3b92
SHA512 5c90632b5bd1b49823bb442c274e1cd0fc278c64d049dca7926acaed113ad0007c16bd952ea17c613ba4c7e9a112a209a4084fda9bd688e186e89f47679067cc
SSDEEP 12288:Nwu6kypfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:NVtypfJ4yL/tNCJPXUQrPl
TLSH
T1DDF4125622D4A098EE7647B89A51C040CB34BCA05F2693EF99C1F53F3FBABD56834712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 a8d94d30690104290f568fcb559d4f97642d82ef5e643c465c0086dd0a67d7be
MD5 286c8f90bbd907b463ff6d4ca91df8be
SHA1 c42c3e92c2a426180560474fbedf0abb13126e00
SHA512 e1497f92b9404117bd45598b95f22c5d403660a2c193b9ad42d8ebaca66c527c78374e2d215c70726d7266f1ebe8f3b408d40d837a1c5968db3b45ee6d396cbf
SSDEEP 12288:PPEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:HEfJ4yL/tNCJPXUQrPJ
TLSH
T151D423AF2194A089DD2687F81648E000C3147EE5272B62FBADC2F4B1BFFD55615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 9670b66ebe54c31decf55784042788da36b241556861325f5d241b653304a38f
MD5 c3cbd4c89d8809fefe7765aaffd6e2d9
SHA1 27ec1b1f78efbc56c1b2a06451718235e003f190
SHA512 1dbdbaa78360426bbc628b50153ae2d6bf8cdbd773ab7e51e8d94d1c8d51b5e4d39b90daf13042d1eac5d655232f638a1c0894fd99e09403cf70cef06a90fd2d
SSDEEP 24576:WC+TyQIu93VAumZr7jmnfJ4yL/tNCJPXUQrPj:W/TfIq+YnfJ4klKXnb
TLSH
T1D6558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 a292c215574f906962dfbb454f33cdf8c1842659632ffd8e4375650de5b4f5ed
MD5 d96d6b80261d63bce62dc99ee8a8bbe0
SHA1 942b137c0059c2fd1398424c3f9aff8d6d6e619f
SHA512 29e29c4b271b50ce227e1d97ed7b8361a57e3dda9747e56d89a4551c30ff79922244c25cd915f95bd851ed3c371999398571d3521ddd0f4ffbad97f8fdbf3384
SSDEEP 12288:FcyrWOstaa3kcsgfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:wLQikZgfJ4yL/tNCJPXUQrPn
TLSH
T110F4F10FB3AA0095D5A7C27C88848102F77378B5572263EF4690C7791FAB5EA7D38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 db988935bacdae7dbc55b2e8be5d32b962fce965bb39be5238e44675aa3de0aa
MD5 21fb6486123ef297f7f13ce75a2ab317
SHA1 ac1110fc407c59c71e112c0cdb2ad35d1ab8fe64
SHA512 25816e1855546b4c88b1121da0f8c83ac5bfe405e95914242601cc84955628c6fffaaead594c2763a6079336b96d6f59c3c29220d5714a5329dda495b2f1ce4a
SSDEEP 49152:CpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPpfJ4klKXn3:/pC7b4+80GTkKfJ4k
TLSH
T159A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c3219329e22430498cfb098e96a71f3fefb2d090181982e971494a0eaec2a3cd
MD5 b550564d72b3baac80d507560fcf5308
SHA1 79765ee8e4a62855972fb92f956b41ca542f330e
SHA512 86f3ac40a688422d4183f7f4331a4614dce09892aeb4ab13799fd01227a90a33128b32be3e6a6b0316c75d276f4c7dd0664a5cd057c9a6798b4a1c1890f3c717
SSDEEP 24576:nSAwJPE1IDAo+4Kt+l4413lUQrfJ4yL/tNCJPXUQrPx:nqPCIo4Kol4jQrfJ4klKXnZ
TLSH
T16055BF2AA7F956E4E17ACBB49663C101FB727823133163CF9290813E1F169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-303-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/912-416-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/912-300-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1052-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1052-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1052-42-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1052-33-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1312-256-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1312-318-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1312-250-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1312-249-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1532-314-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1532-248-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1600-525-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1600-394-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1600-378-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1600-410-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1600-331-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1600-337-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1600-340-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1616-524-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/1616-327-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/2040-27-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2040-26-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2040-17-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2040-230-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2236-25-0x0000000001050000-0x000000000114E000-memory.dmp

Download

memory/2236-28-0x0000000000400000-0x00000000009AB000-memory.dmp

Download

memory/2236-0-0x00000000029F0000-0x0000000002A57000-memory.dmp

Download

memory/2236-5-0x0000000000400000-0x00000000009AB000-memory.dmp

Download

memory/2236-6-0x00000000029F0000-0x0000000002A57000-memory.dmp

Download

memory/2348-273-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2348-326-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2408-420-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-445-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-459-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-458-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-457-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-456-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-455-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-454-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-453-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-452-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-442-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-443-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-446-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-449-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-448-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-447-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-444-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-441-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-440-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-438-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-439-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-437-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-436-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-435-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-434-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-427-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-428-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-430-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-431-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-433-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-432-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-429-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-425-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-418-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-419-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-426-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-422-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-423-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-421-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2408-424-0x000002B049180000-0x000002B049190000-memory.dmp

Download

memory/2528-507-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2528-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2628-268-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2628-323-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2628-263-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2628-269-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/2900-450-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2900-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2916-319-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2916-451-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2964-45-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2964-51-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2964-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2964-232-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3140-312-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3140-417-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/3240-79-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3240-56-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/3240-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3240-63-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/3240-74-0x0000000001570000-0x00000000015D0000-memory.dmp

Download

memory/3240-310-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3912-229-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3912-11-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3916-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3916-233-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3916-68-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/3916-76-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/4524-242-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4524-240-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4556-280-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4556-412-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4704-283-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4704-289-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4704-291-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4704-415-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4968-339-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4968-473-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4968-276-0x0000000140000000-0x00000001401C1000-memory.dmp

Download