6d70becbcee6c134232a07af2cec13c6f2d892ce83b76b520ab21ed5b7a98f74

Analysis

max time kernel
148s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 909KB
Sample260516-ls68hsct4v
SHA256 6d70becbcee6c134232a07af2cec13c6f2d892ce83b76b520ab21ed5b7a98f74
MD5 58ebcdbec0d02dcad7fa04397dae1b36
SHA1 1a4a38e427cf38949b886a53d2008b08702dc8fe
SHA512 f20883ff5af4ed9fad4f601dcb2583a1fe26a9ee6b9d0f4217b365f2f82a3b0b351d004a4bb3e4c4bd4f22bd3e23ffac0e37d9a05b11d56e442f4b2ff5114d0a
SSDEEP 24576:AQusSXU0JlNftDLD9F9rrHbVti0VFAguFqAzWdRf:AQLAU0Jj5BF9TH2qdF
TLSH
T1C015F112B9A9C032C46302330F75B761A9FEFE649F9160C753E02A5A9E74DE12935F72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4840	alg.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4388	fxssvc.exe
3880	elevation_service.exe
5824	elevation_service.exe
3712	maintenanceservice.exe
2932	msdtc.exe
920	OSE.EXE
2560	PerceptionSimulationService.exe
3260	perfhost.exe
8	locator.exe
1672	SensorDataService.exe
5504	snmptrap.exe
5412	spectrum.exe
4484	ssh-agent.exe
5284	TieringEngineService.exe
4572	AgentService.exe
2508	vds.exe
664	vssvc.exe
5836	wbengine.exe
3004	WmiApSrv.exe
3484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4fe633f5396076bf.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a797bbbb9be8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e60ad4bd9be8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d852fbd9be8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035854ebd9be8dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a355e2bd9be8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1a5d1bd9be8dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
4804	DiagnosticsHub.StandardCollector.Service.exe
3880	elevation_service.exe
3880	elevation_service.exe
3880	elevation_service.exe
3880	elevation_service.exe
3880	elevation_service.exe
3880	elevation_service.exe
3880	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2992	2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	4388	fxssvc.exe
Token: SeRestorePrivilege	5284	TieringEngineService.exe
Token: SeManageVolumePrivilege	5284	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4572	AgentService.exe
Token: SeBackupPrivilege	664	vssvc.exe
Token: SeRestorePrivilege	664	vssvc.exe
Token: SeAuditPrivilege	664	vssvc.exe
Token: SeBackupPrivilege	5836	wbengine.exe
Token: SeRestorePrivilege	5836	wbengine.exe
Token: SeSecurityPrivilege	5836	wbengine.exe
Token: 33	3484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3484	SearchIndexer.exe
Token: SeDebugPrivilege	4804	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	3880	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 5888	3484	SearchIndexer.exe	106
PID 3484 wrote to memory of 2496	3484	SearchIndexer.exe	107
PID 3484 wrote to memory of 1160	3484	SearchIndexer.exe	108

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_58ebcdbec0d02dcad7fa04397dae1b36_amadey_cobalt-strike_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4840

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3972

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5824

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3712

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2932

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:8

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1672

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5504

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5412

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2752 2912 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2496
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2940 2936 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 adff5ad317d7fe0b5c11ae91330be7fe346458b4b7be0a1ab67eb3d34e0f1574
MD5 1a811762d126aab7cee72fd25c0f78a5
SHA1 2a0134424efff66a8aba4923ac2dd86c16acdcdc
SHA512 cdad903b992715a7821cc46f6404703f7525c56a199f93cd2e52a19dc62ce77b82f71eb7a3793fb8e5299043033eaf543ad9cc9a7e804ba4095da8f6cf6255af
SSDEEP 49152:lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn69TH2qdF:73q6mjBn9TH2i
TLSH
T1DDD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d625ad4105c07b97ad685d179e622ca5b864ecd89d58b82277e29a006aa8bf27
MD5 d13bfe25075c92ee8c3a2eb30ec70e88
SHA1 480900395a4869a8df25db51bca6958159bfe977
SHA512 181d4374f6a5164d4d4f00958c0c9dce225d0cb86cc564f98869d682f63b3e985696f2bf2174e4d898e640b3cac42b2d6a09be30bf6799a9328871c12ea09486
SSDEEP 24576:tXYfDtczAb9rrHbVti0VFAguFqAzWdRf:4tcI9TH2qdF
TLSH
T18C05F12967E408F9ED67827CCDA28012EA33BC9047A0E69B03A0D5665F337D45E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f6ed82a8f494f8dec6c4184dbf283b6e40d7adcc0348a79a13cbb6dcadb282b
MD5 75ca6201a8ce3e7767b77b921775d836
SHA1 4eec300f9d863b40e4763e0cd513663c461eae54
SHA512 6a2b33853169fadaa0485dd77be5321a3f096091091d75ce185cf0744ec9048464e04031a30152d940184de3410ab40483620fa90a662765fb42679aaa47bd6c
SSDEEP 24576:20Le5ji0hmxhrMS9rrHbVti0VFAguFqAzWdRf:2Pji0Azt9TH2qdF
TLSH
T137359E16F6748331D073C0B9C5D2A68AE97234865B3089CB4286D77C7F67BE68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c16abefc53f4b59b6ddfdd28119c0f1c26f0934e04789731754bc98e196b64cc
MD5 ec6e642cd42fe70966b49ad0f10deaa3
SHA1 fbde082e9216fea9cfffaa7c842eeca4efe7be4f
SHA512 439f43aaa4b4464ac054c2593c29f63db6ccefc82bd518214f838d68340abf71685bbe43929a233ffbcebf2a13dbb0a58fb73fd3bbf5b275841b3fb1f93bd9d7
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWj6q8wyu49rrHbVti0VFAguFqAzWdRf:y/ezSC6vUzPv+Hjyx9TH2qdF
TLSH
T146755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fd3f530ff5d6a2c610d175248d61f1de052092984ada9c52b4a3bc2cd2288410
MD5 f0675e3a32e887d9ec3db839a79363bb
SHA1 40a4959c1d996a9b499a340a8f9114f61e0a87ea
SHA512 3f80e24f0e39a41e27122d97247f92dafae35509ebe9bd15b19eb2da5b4c860c75fb8d7ae3178a8485324b4b08b56d682567a46341a2956f716de8979499214f
SSDEEP 24576:mVbqPb88hv/l+BX9rrHbVti0VFAguFqAzWdRf:mVO88hXl+N9TH2qdF
TLSH
T1D2559E66F5B48331D073C0BAC4D3A69AEE3234415B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 243a9beadc131f6ccae982e9091f2d6771b5b3d6fb29700998ce9808177fce26
MD5 93997d2e08fb9ceb34314fe9ea03637c
SHA1 d137d6aab52c1ebd12456cf4d71ecf3210905fb3
SHA512 405840c9f9cf369020c89c82cca6f4530df40c1bf42adb67ef6602448468b531a8092bf6ad8ddb5a6871a47269758398316051f8f13ae6aba56f570586d30148
SSDEEP 12288:rGuk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:rGu9rrHbVti0VFAguFqAzWdRf
TLSH
T1F1C4238E8AE84463DF5703F56EEB20167516ACD496A0EC21A140F1E2A93DF61FCE1D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f01046dc7a5a482e34c3e527bc442ed217f7997eacc576fc6a32bc5d2ebff525
MD5 8463b582e60fe8b6da9862bc13a0405e
SHA1 c255f4950d1c2c2d864f38432f77c2faa0038996
SHA512 25b4f335bea97c1af7739e75f21253e8cc660065b42990f1e9e7f83de046c015b25e8fcd1f7326742537ef320a31812d6320f6901358819dc41857649be36f0b
SSDEEP 12288:UeBNUbTVO86Uvk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:UJIUv9rrHbVti0VFAguFqAzWdRf
TLSH
T1CF05CF3BEE68FCE2C67A4DB85B918200E77278704B61A3CBD164C24EDE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c349d85ecf70907e33738a7fff3352861de32ccef049d4590a33b73866131745
MD5 36720fedac9b97283ddba3b3c5f446b0
SHA1 474acbf18901f22775daad47c5dadc15feda7b6b
SHA512 6143a8422e0bfdbf4889805c7aba68c92fed45363b0aadd66eaac4aa4d0f2179ff64dd5739d568eab949f050905a898ea58da444b235683ebceafd8fc7bcaf22
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:LQvGAdlCEL8c/WRNw5Co9TH2i
TLSH
T1D9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3006de26e5dc42138367b36c7ba627c5c6227074c26cb34b52678971eb3ccb0c
MD5 aa711a40b31cee8b0208bad9afc82d0a
SHA1 af9b688cf734655d14c14be466a070b61c607522
SHA512 4e9b9df7710a03bd5b711161fb6926a5ebdbd5f3b3fbeeda2deaa70f58389391cb0c44e50f5d01e0ff098ef39a522055fdc240f38c9f4a3c195bac578ea24ac7
SSDEEP 12288:EAwSfxL/2Dc3mDLLmt0LDQewsAjdk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzr:ZfewsAjd9rrHbVti0VFAguFqAzWdRf
TLSH
T15415E031FEB4D032C77B0DB21B76D316142DBD604B6119C3E3A89A9E59342D227B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fa686f88b79a2e86cf5344469cd8d221f2ac369058d984a4643ad2df8eb005fc
MD5 cf62622d114ce18556b525c863c805a1
SHA1 d8864a8d3c1b228bba0008cdc3cdc5fd6eac5c6e
SHA512 964089724fbcedc3efe529eba05bd8e7108a0aae2ec0dae7b03ef9cc163619032414a2a2c30cc5062a1badcc87b084701e1104bdaf550d11c729c7c89c077e30
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHF93:uUEtQevvqc2W1cpV20I32D3
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2179bbdd7074966eed2e336e74fb29b591946b3e55264b9966cc0d7b22d07b5a
MD5 8151923dcbd48af41ff229b01eff529c
SHA1 7921047b290bdcf9030d407296c239c6baa461a5
SHA512 e6ec56442d0f3f3ea63e7817262041ac4f1d8d5c846dd35f138127dc19a7a9ad629da7b05df06e46153c4c48e2a4518213d6efe20419a47c8672c5c3ab6c1521
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/z99TH2qdF:eoqtVjnm89TH2i
TLSH
T1BCD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 666f211218601becd3700bdf6419ca8e56dd61f40d3496187e8224c8569c369d
MD5 cd755197d15e9400d1b6d1dd8228edc0
SHA1 2d6a68d6278f0b83dca30d1b89f9a06be352e25d
SHA512 e8b9f82e441c39d35cc60816c65b022d57256b317d4b472d95fcfd4cc9b3981db3d0038f8aa1a3cb68cceb99952b0ed9c0381d82f0357be0603fc41ab22aabab
SSDEEP 24576:3AhGL6IFoiwtA5l7S53c9rrHbVti0VFAguFqAzWdRf:3AM5Foiq5s9TH2qdF
TLSH
T12F359D81EBF945D4F5B3AAB899B69171EA76BCA95E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7f2aeef882fdd0e95a42eca025b1851d02dc7ca9900328ed698b866547c7851b
MD5 150b8dbfa101cf899e91488ba2e97bbe
SHA1 8a88cd16f4b6f1657b4f8cbead2abce1d42fc8fd
SHA512 979e118a3b65d9c99cd22c46e7e0efd4ef1fe3d19bd4aa71a239dc8ba246fe6f5722ad598615e3626aa17506f732ea31cb2df4144af5facb2e5169f89eb37c22
SSDEEP 12288:Lmw5HEjsChNEBFgl0WDm+CYk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0Kh:KwuROWR9rrHbVti0VFAguFqAzWdRf
TLSH
T1B805F14A77E40CF9EA67427989978136F7B2BC112A21DB1F1360C2576F37361BD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 64558b0d3fe579073ea22a39cf30d734af75063ec1ba7fa0c2e216e2d92af91f
MD5 eafe3c1065aa55e7748229b2c42ef232
SHA1 e8def45fa0039f98afa9929b6d38f305e512a9bd
SHA512 1138a87bd7ecf3ff254f4998b2ca44d03d66af2fa368103eb0f3b15320f21e193ff61d75de2b996a8d3ded8b0fde84b876083b68fcc981c6efd921887e361d9a
SSDEEP 12288:tyZ1IyNk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:0Zuq9rrHbVti0VFAguFqAzWdRf
TLSH
T13DE4128E23E820F6D69302788DE61106E7727C91677193CF225092A66F37FD26D75B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc02dc3482bc3bbea3cc46ba9ba379c8bb1073471f2ee2cd5b9f42c459ec36d9
MD5 d14e80ee8887712b1c63e7fd516cc840
SHA1 c2859c139d02808c7bd5d490d054d3d2646552d9
SHA512 34ff1909609074b55e24d509ee26424cccfd38df5373dfd15fc5a19dc1b3141b684295d7ed25c63ac40db12a747df7f4430adaefa49af7931a8d3221a3c189d3
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UF:ZQRQyi36YOcPDLvw2gAf+PN3z9TH2i
TLSH
T1AB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 13392e4a67762b7d67d8922169f7ee36068d7e07e49d564198e52eff608d3e5c
MD5 55e17fee2cf883ffa1d2d79d363b78d1
SHA1 b72e4c8ab84650f62090927a7bf9eef52f3a55ca
SHA512 6fc2bca7a58ceb144c04b4decd0709abc374a630c4c21644c08ee24aab84f9febda6819948f062abf49dca1c465ec0a59370dd9c024890a9dfb0b4a361a3f504
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UF:8QRQyi36YOcPDLvw2gAf+PN3z9TH2i
TLSH
T1BD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 348574db00ac0dcda51302ba5fd13948e6000215b263547432d07d1a5b7184a8
MD5 30501da5680ddf70a6de5487cbf71077
SHA1 356abb64706909c0e9aa3be2d1be90f7b369844c
SHA512 d2a52e944500574862067f9aedca1f5a3efe2560fe1a2688fe683df4bac05abb8609855e40af9554559f98f704d25b14026721a1cb7d82db6eefd1da97bd28a9
SSDEEP 24576:wwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL069rrHbVti0VFAg7:268Qg55nhkeWu7PNU3/t9TH2qdF
TLSH
T1B8B54933B2F600A9C44DE1769F4A972196D27C758FE0E3DB850172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 490c61637c6b21c1c5b65087902a14ccb1412fac106a96351cc80ee206d0ebd0
MD5 3e74fc1e5fd4332fdcdbffb3c86b3268
SHA1 70d3288ad4dc6a213e71d3f5418acf126ab3b9bc
SHA512 6315b6d3ed3b9bf8e0d7c81598f25e829e66e994f4adcf0dbbd276f23fbb3faf5903e61c198db92d124bc236193388a1c69959e20a1039e69ce389f9c66b4dc1
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99z:Cy5112gYy5azzVvU69nLKnhZu9TH2i
TLSH
T1AE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2ecd00e09b8db34c46a942defc8c4d9f74fa471c7346c10259cf4f15a8a0e0d1
MD5 a81d5e0fdc38e790a51a7b84d93ff46b
SHA1 e8147d6b4e1f709bc7fa7030c6c9154868dbe82a
SHA512 16a9441397c9bb602ecf408c1b7e36880fbf1fda9a49aca6b88294011ceec57eaf18286151c410fa6e524d1dab4ef8fd9d8951f91b3c7e5b114301ae7a41bce1
SSDEEP 49152:3B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glr9TH2qdF:Zu6JmIxd2dr9TH2i
TLSH
T1CBD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ecc8138c5981d1ce8e90e783148a16b6055f3a74bc18abeda80865289e1bfb72
MD5 94033eb38991db4b0ff9a04e33f6c048
SHA1 d54d91de026907f8b84f8c46aac15fb7691398a9
SHA512 2d6a10122df86cdaa8f7a86d20edd368da57b4f7105a78caa12c130eca367407f3fccd533c66b8c596b399d6fb7e4cb891d67519fe5fffd8390f53d1ac99a22a
SSDEEP 49152:U1hpsNoJpF1A67U44CwH7R4xP9TH2qdF:UmifPqR89TH2i
TLSH
T17AB5AD13F2D900E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a8410e6a1402f90480e926a5a6a3df3d36f3f4c27498b5eaec0e5fad1a0fd32a
MD5 277ffef15479683c6f4714e7af93035c
SHA1 716f1eb5e10b6392a24fea5587d1aca6723acd86
SHA512 4e5f6b877b5c402b49e711fc6fd6d4c388e9f4aa82f73c02c3ab07010730fff958566ec7dd4d9015b6d0bf4c8913fb57386de9f87e7de770afca5a6644b4a2ea
SSDEEP 49152:nSuZQIY0Be2KkRVtOnks6NMHqq9TH2qdF:95dKqi61q9TH2i
TLSH
T1ACC5BE03F2E940E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 de189f091b43da8ad98c5e36a77ba3c97d84d3ea9e63141fb0a7bc7fe45eab03
MD5 a75236806b5b19452196b0b40a9c5545
SHA1 d890c3c3ee98093ddc9b9cd8c1d85f3bd0c01818
SHA512 fa0a8a62a9fe7a8095bb9a4f5a567bc7c4d1c3f93c5a058ed0dc2e171e1b9a700f6594bf4bc3d02061f65a55cc1e51af6f04f82c3c64663c4de173cfd54f27dc
SSDEEP 49152:9htSn8EApI0figjgiDn0AP5wb9TH2qdF:sX2iWphQ9TH2i
TLSH
T1F195BE13F2D900E8D05ED178C7568632E962BC150B34BAEF0A90B6561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 c1cd62d6869bdf279c4feeae2a378efa64e7333a747757393451f643987df267
MD5 284ce016b6c3daf94252aa256a9c4ed0
SHA1 7c259c13108228745e81b7c5b95be90235ca7347
SHA512 7a3dac60496f1a6a64f3d517b92b2000aca01b4f741f53c549561fb31f2e1f48dca9738668e9c6b05551d99e322c9905a177263a87dbc710bacd6f5da78dd477
SSDEEP 12288:xGk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:xG9rrHbVti0VFAguFqAzWdRf
TLSH
T1DFC4238E89ED4463DF4703F59ED72006741ABCD4A7A0A422B240F1A2AE7DF617CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1640c9bd095de3eb56572ee5d373f9f86a551abaf5b4b266b430fa448de9a784
MD5 9984dcae7187cb792cda21ccea96d1b6
SHA1 7c6e2ba5d4d4a265994226352b1a55f4c34cce50
SHA512 66fd2ab6b0102346ad7ee0d268973dddea2512ebc3354c399836c812ec0322e732777f3712195663b9dbd884e5c058dc506846715003c15599fdfdce74eef45f
SSDEEP 12288:a5k6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:a59rrHbVti0VFAguFqAzWdRf
TLSH
T140C4238E89ED4463DF0703F59ED72006641ABDD4A7A0E462B240F0A2EA7DF627CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 eb4ee90fbbe39f9c7076148be9073e68826b562311b5208c72c6974a4c8c8e54
MD5 c44d58723ace51e9dbe88c2468567560
SHA1 1b0b65a232397cdc99b45dae1481cd9eae4e1e7f
SHA512 561eb667d7a8a5e47ed2b33bbcfd052900f25908698e826a08a1c44433de1d31f4b3d616d061dabb6e9b963629616b5fda540ab42524fcd6deaf811a1c7d8052
SSDEEP 12288:Mnk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:Mn9rrHbVti0VFAguFqAzWdRf
TLSH
T112C4238E89EE4463DF4703F59ED72016741ABCD4A7A0E422B240F0A2AA7DF617CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 e6bc11bceb230c884a54c4f8818bbcb54f4ca2a9aa746736a713f18d66828995
MD5 1fe4789f7d2e2c9e8c7d331f1849ad21
SHA1 93b64d2ce912964fd1799b4ec497bfdc766ec08c
SHA512 2dd7070e6b121175f018e8ad6080d9482b6178760d760686cb45bddf4ed5de67e468dbbaa18e259e8b43c3637b1c5a75446df067a1a22ff1a87b96688a923d1c
SSDEEP 12288:0V8k6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:z9rrHbVti0VFAguFqAzWdRf
TLSH
T1C3D4234E5BED00A3DE5343F4CEE72016B166BCD4A770E567A240A0A25E79BA07CF0E75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 618f16cf15fab21ce93ac4991ed0011cd1cc9baef587ffebcca86abf3d1ab2d0
MD5 108f7173e63b9af951c7889cf0943718
SHA1 2a4be1dcfb6cbad8a2ef246f54aa99b39665e9e4
SHA512 290b738952f3ed76fdb94ea93957b47df1dd52dc152ecf24e43c465c3e8247016e72f8df5e79abb8d5b42eda5a6697b31d83c9a3765ee389a1d9bd6bc3142964
SSDEEP 12288:ekk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:ek9rrHbVti0VFAguFqAzWdRf
TLSH
T1B7C4238E89EE4423DF0703F59ED72016741ABCD4A7A0E462B240F0A2AA7DF617CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 2447b3f56a59bf9c34444dbb80a17e8fe14b53d0d7bb32e180443377510a1955
MD5 d6bb13e6aea10c9e5f59b0f772992c23
SHA1 c3b7a14cad5bad2a65db9288fde719f8ba7bb891
SHA512 04a5a014447ca36717815c27a752bc6855e2f5ca6a690345d4a1c5f021b46469b2a0547413fbbef9188ff76268a5f362719f079c4833a8b65b299d9b3e984bd3
SSDEEP 12288:n1k6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:n19rrHbVti0VFAguFqAzWdRf
TLSH
T118C4238E89ED4463DF0703F59ED72006641ABDD4A7A0E422B240F0A2AA7DF717CE1D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 485a84b83ca4ce9842fae4d3f6b6ef8472a78176f032ddca0c2541d16d118c05
MD5 4eef16a1ecd8ef5fcf90b3f2f9c3c74c
SHA1 01544fe0ac756e28fbeb69c3ab5a4e3256381b37
SHA512 7a28a3f58b2ad3adec04d69ac36e9584d70d69b3f553b444b7b6b341563345d2a90d5e86fa0b50a6c054f50ad2b30e849b07a08f90af5e7f2c044f056cc16e62
SSDEEP 12288:qhk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:qh9rrHbVti0VFAguFqAzWdRf
TLSH
T19FC4238E89EE4463DF0703F59ED72016641ABDD4A6A0E422B240F0A2AB7DF717CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ec41d99954cf0c2cf9c515d87fb9c6951703c3f295bc05584676ce664fa1d4b3
MD5 867e6c21dd7d4ef3de550ee7b0d65481
SHA1 84b09a38fdc648ba19d29d3a112f57e9bf04ea14
SHA512 f103e8101a49c585a5cd44c69591b24cab1829205b10f0841cf35560fff8349e3a4b63aa8df4af148ef33b2ffbb0e23ac034a56bf58348a527343ad2b8f624b7
SSDEEP 24576:7ZM3zFVSOZ9rrHbVti0VFAguFqAzWdRf:7ZM3zfl9TH2qdF
TLSH
T16C050199B39008F5ED67427ECD664406E2B2BC590B60C61F13A432675F337A11C7EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fac40385a2f2909b91426eab02d8e2a78c5b8034c1f769dd4f28176a67603859
MD5 c74eadfbaf8e856203018e20aa65ab67
SHA1 d7a545079abee96f6cbca2eb9267c6dc75b08087
SHA512 269c5c8b2b137e2435d447354aee2c3dd28aa72c190740461ad7bd15df7e101f746d45f996f7f2ce7649bbc9e6633c3dc99e27cdb33c327dbc87704ea8346179
SSDEEP 12288:cak6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:ca9rrHbVti0VFAguFqAzWdRf
TLSH
T1C6C4238E89ED4423DF0703F59ED72016641ABCD4A6A0E462B240F0A2EE3DF627CE5D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a9a2d3c98dc6a1eb8e66999e133136bcf7157dd400ea69d7fb10663ce38203de
MD5 aa71342d8f05edbe33d9e1c5554eef3e
SHA1 7118d960d97d1405ebaf6b7f945dbe5131eece60
SHA512 56b11592d969a1f3f545181e39034278c39fa9f85377a3739c3395967275a70132ac4a2ac97df459d3d366f6217d38811c015bc4ef10812738637bc1c73ad496
SSDEEP 12288:Gek6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:Ge9rrHbVti0VFAguFqAzWdRf
TLSH
T1EAC4238E89ED0423DF0703F59ED72016641ABDD4A6A0E462B240F0A2EB7DF627CE1D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 e3a9dc1edbfd31b5c96f99046cd021d75bb37246b7cda98934a6b8a0f7496859
MD5 f313fdf1a1f9945e89c655f9895a4f62
SHA1 44c8b4251438573da4fb3ca3f99698efd4f2d0b5
SHA512 11f4bc45a605d77ab88255858d157f20e3929a06be9a838be4de9fb0c19fb75069a85a8241a369d81a1c433503ee113a72af65c71b8b787d4066c498bc90d5ba
SSDEEP 12288:ryPz5L8Nk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:GzyN9rrHbVti0VFAguFqAzWdRf
TLSH
T160F4024B67E520F9D6274278CDA21502F372BC7147609AAF639052B22F377A16D7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c563b7227a474f171b7cbb5741ca861ac11315d9ea968b00d11ff0930beb86b9
MD5 033475c8034adbec743ffd092f0ebae7
SHA1 f23557c1aa9e6432ef6a1aae6f6d3a9f8535e51e
SHA512 ab43118a7fb4144bb35221e2be152417aa01c71a1a8b31a5847a87ea80ba41874507829930ca88a6f14bc22637ed54e865d411115226697aa5f78e23be822057
SSDEEP 12288:Fak6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:Fa9rrHbVti0VFAguFqAzWdRf
TLSH
T146C4238E89ED4423DF0703F59ED72016640ABCD4A6A0E462B240F0A2EE7DF627CE5D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 8a82fa90a28ec432d3a2011c7f93e073d6ab47224b0c9fd7dada34b95bf6a250
MD5 167619b74c43312b7b2bc35e6bf53ec2
SHA1 a6db1ae5b7c617d813fb4b6e00da3c9b529fefe0
SHA512 d2e7833ec8f04f2c715e1dffaaae1ade870620aa58077bde27e273d84fcd7a5934a15971cc678f17cf5370ff54cff278be4a66f7da82c799e58224303eee0739
SSDEEP 12288:Rak6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:Ra9rrHbVti0VFAguFqAzWdRf
TLSH
T1B4C4238E89ED0463DF0703F59ED72016640ABCD4A6A0E462B240F0A2EE7DF627CE5D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f7b06b032fa4fb0c05c62befcf59aff0792b5f662f9ea0d869f0f1b14f9ea866
MD5 88852e1d404e029633dec7af4a96b1ea
SHA1 0a4df428a7cc800f126eb1dd333568106c33d5df
SHA512 ef0ec2623944e51f7b8082042e30221a827713996f5ab4a7e903d492953cf737be77b1394b83de0a8a76afdaaca928396a0b85761441d1283dd5e27196c3a279
SSDEEP 12288:ZyPz5L8Nk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:YzyN9rrHbVti0VFAguFqAzWdRf
TLSH
T1DCF4124B67E520F9D6274278CDA21502F372BC7147609AAF639052B22F377A16D7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1f5f52e308064950dbab2feeecd06ee05bc9229d70ed78a1aa15199e6437edaa
MD5 b9abf98488cc27d1f2681360c9a882bd
SHA1 d1701689ecf86fdb87c2e5e234ea5b1ef7cf4ec6
SHA512 e1ac7e42180247d0ae61c5cc61ffc591b4894adaaeae0700bf0a424f68a007e555a7c391db9bed5e314b4775c348aeec4d440095948e0f73a356ba3c991332bb
SSDEEP 24576:FCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAD9rrHbVti0VFAguFqAzWdRf:FCUAPTY+8Wg2lIL8lrIUJLWwk9TH2qdF
TLSH
T16A65AE1EA3DC0896D4BB81358A518A06FB327C2A1B21D6CF2160C37D6F27EE55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 96126c01f64b8011a9fbc0e76042f151ee06d752c262e838ad606ddc717975b7
MD5 744714345aa74981c391ae0d1e3a3818
SHA1 27d87addbda09a8afa83b0db1ec1ecde18e5da13
SHA512 59fd197de37f4d2843ffeba1244ffdecba471c5afbda4e7fd60c510d5ab9d97ad0a952398d91ee276e7d7383b7fa5ee9e01667fc19eef2093da6e74e7ccb33c2
SSDEEP 12288:Lpsfqk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:8q9rrHbVti0VFAguFqAzWdRf
TLSH
T19FE4014AD29801E9C56E52B5CB965201B3337C6497E1D3CB63C0F17E1F3AA906DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2e5ded201bc3693d7b664c002c8ee63ce1aee8164d81884c5e18d1f877d08fd4
MD5 60dfedfce9a39284b8c3730cda0027f8
SHA1 d83a420ce976be09b2e7f20ba473e31dd4341c15
SHA512 eebd3992998d76727ac1e7c88ef4e570033cfd973c3e9ad87107fd667988055aa3409203b2ac0da6f630e32387585b536686de9994d51ecf4e054aa8eaf1aac0
SSDEEP 12288:qHk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:qH9rrHbVti0VFAguFqAzWdRf
TLSH
T198D4234A86DD4413DF6703F05DEB6025211EBDA49B60E4D3F140F1E2AA39EE1ACF1E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 56d2d627d0cc20c73a527a6d7e5754ad050cb29d9a0ceeee481512ff1d9e6029
MD5 5a1dcd4d309f80eb2a44bca2c4f56b5d
SHA1 fa73006d7657ec7d797cb1631e38187e60e18058
SHA512 2d9d1f0497cbd25bc56a3a7c3e767889111f0a7936c00f3890e86c695a19fb5d77c49de71a18a24e661abeef90f3b2a8beb53ff98e2863152cfb3fe9bba16792
SSDEEP 24576:d8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC99rrHbVti0VFAguFqAzWdRf:iRZwQCyiHiQEaaPnMy9TH2qdF
TLSH
T12E85B01E62DC46A5E0BAD2B8CDA74407E6B27816473197CF1190C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 7b6a0363a2b135b24fd184f31fff7d1e7033f6fc4a1cc6ee7619d54d3693b98c
MD5 beac6961fa58f33f9aa6a7153afce500
SHA1 c44f90fdb1ec271b9a50374cbe618e80f796e79d
SHA512 e0751f27d68efb3a23961198860a15164b0a8b6d26d6d7ae983d15df0732c6b2a911c32c7fcef94412516dba3ef4df019b078777debdad6e82c5c66264f4d506
SSDEEP 12288:KbxA1U7K3k6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:KbxA1UG39rrHbVti0VFAguFqAzWdRf
TLSH
T181E4121E56EC14E2E67692798DD64006E332BC651720A7EF2180C2BA5F3BFE06C75F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0295b43baaee2902f0037d7eaa5b24ecc54a132a28cf9f3f8f4087db7db6ac9b
MD5 6308d1ecd5b51efe9080ba07ba40fa2f
SHA1 94c29fc71a86ae5bb49987c7914d52b86cf7311c
SHA512 0e70f59ab95a3e3fe705aeb5bbe9eadd5e1f904f4706dc84a4a02ad4762f1f3a4d8fe095ecc405be3c9f715c931b2ba739c3c6737210489abd215a924038c7cd
SSDEEP 24576:hjsmP0yHaqrVqHra44KDzMsrns9rrHbVti0VFAguFqAzWdRf:hjRP0yHfVqzlAsrns9TH2qdF
TLSH
T19945AF2EF2B910B9D8AAC176454107B5BB71B82D1F209AC70170C235AF1AEE49F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 b49a2747173c6cc84d01807e9349b662f66ccd8049f599eb3166c3ccfb60921a
MD5 a76be6d4ec9555e81841115cff4dd50f
SHA1 48aa9530e5376ffb416cd89fa14ce94f41794f3a
SHA512 fd084a199a43ae6d1c5fc69ab51439b97d725a3b86ef4fde981643540d392adaa96aaabe4caca7ca215948cd1e8883687920ff71595ad873963d17d35070306e
SSDEEP 12288:HVk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:HV9rrHbVti0VFAguFqAzWdRf
TLSH
T167D4238E8AD94463DF1703F55EDB20163009BD9457A0A8E3B140F1A2AA7DFE26CF1D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 4c9d4906012efb6c4bb385bd8b69933b313b7b6f380568fa9e578936c5492f62
MD5 a1394d6cc54f4272f14e3c8c091d0f2a
SHA1 3938ea7c76a7b81de94824caae3d2f29b695d81e
SHA512 a7504a3dd5c938d01d4f025de09d692c76d65eacfd0d4d1c2a04f448078b51270161608766c186d7ea9e192491af9e1a61ef8fed6fa390f7ea798d033be49711
SSDEEP 12288:CObIA4LWO+vAYFTbk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBF:zALBUTb9rrHbVti0VFAguFqAzWdRf
TLSH
T178250249E7E400F5ED67817CC9A79517E272B89C0760E7DB03A886661F237E14E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 110fc5f665b2fd7756d67a5dd08bc5bc4d504ecad2bf610a102eac9e32437455
MD5 e91bd4547c9c911fe0eabab16fb9465d
SHA1 f0c24c34d9d422bd6ebe7f2c529df22a8814ee6c
SHA512 559f5468a87b7148aa3beeac801e947a646b26094bac722131fd4c3c4abcc9778cbbf1e795d2ec77260252a4076cb9d90f92179d61da61f5e431bc63db390b25
SSDEEP 12288:q70VmzIYNvUyBpWk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAo:bfYNHA9rrHbVti0VFAguFqAzWdRf
TLSH
T11305F11F52AD08E5D63B917D8AC38109F2737CA6171192DF11A0C2BA1F27EE97C3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4c8e324a8b54dcb1e8bd84e7524f3123ad895f1c934f2b273f8ceea4a5a81044
MD5 92eda17ba8e7174391cf0d1c2e869981
SHA1 dea31fc17d41d91d34ec71b05120f4d51aab0896
SHA512 6a2f37177fd78671b7808d523800462425aff7d52496eecce04b7f1add869fcafa7679409cf8e539459460c60ef178a157f9f1f3e59d58a3d67d869632067357
SSDEEP 24576:bnXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKf:bnXoJJYH84VVS6AmETJas+cHBjSSKHPv
TLSH
T17765BE9EA2BC04E9D5BBD17DC5C24506F5B278611331CACF026082BA7F27AF56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55cc15444ff92ca4bf122c653671bfcb1c0a9ad85e1d0e8ff01cab00a8b30c09
MD5 974fef416c16b9cbf0f578a16f1c2626
SHA1 32030398939963555502869f836db5e92bb00a17
SHA512 82469f8586231930201451954e636a9608d823d91313d599eb22c550bea5e8a36c7e1f268d97cd74fa36ac5c2857ed260bd809e8939a802e6a89d4ae348965c2
SSDEEP 24576:jv7Xbxd9Tuycf8M/TYlSuxwr2PCO9rrHbVti0VFAguFqAzWdRf:jDLL9TuJ0M/TYW2P19TH2qdF
TLSH
T1BD858D5EA2EC42D8E47BD6BD85B79046FAB2B855173081CF1290856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 36b3b02c0d9b203eb6e6d4518c1fbda1e24e8d01810313841500f0c07c63c7a0
MD5 5638fd22d333ab339d3202a76d2c9db0
SHA1 39dd80ba7ec98a805032e4243fe18e555050e66c
SHA512 91f2f5fdfe1765adf85d5981df59ea64a816edc82e75c1695ce667690ecde5d780fe7f22fd7934701b31c08918cf3751fed58428d64fd85dcd1728c210d66fbe
SSDEEP 24576:BegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wb9rrHbVti0VFAguFqAzWdRf:BngOJOmPOHkb9TH2qdF
TLSH
T1DC55CF3FA7BC15D5E03EC17D8A978816F6B1782603259ACB0150827E5F2BEE46E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 fb2e72785a6ddd194a933fc9964584673f02f0fde478134606195d460a99cf82
MD5 8746f294609eba9a11b02fccd4aa1ecb
SHA1 c80899e53b1c836b4202248273a384057f4ebce6
SHA512 703fd584cc155e0939ab7aa2d999ce00a481ac9e70b881e8b4c59ca7894361fdd38d0c1bbdb34276b0230427b9ca25e55b07b0a03c0ca149782874f00ac0eb66
SSDEEP 24576:ZLJnJiTk3R3waE4JrO19rrHbVti0VFAguFqAzWdRf:ZLJnJK8R304l89TH2qdF
TLSH
T1EE15D12DD2E810E9D4B7C2B4825A1656FF31387C2B2169CB69B4D5313F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d6960cd85ec61f6b5860c597cc4be9ef900f4b0373bec34abf0a3c757854d319
MD5 f06b856212330a360b9922bb79ec245c
SHA1 d1c563c3657c0f6e98d3dd20d0ea1b6e7e6581b9
SHA512 277f062fef56e056aca6c14fc0c51511830000526c6d10b31066de7c94074bf216b40231a9e5b8041b5c4bae4a8a730784d0552af203cdda57d94cb0c280168e
SSDEEP 24576:aA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pz9rrHbVti0VFAguFqAzWdRf:F9GqCzDScAZmlvTcFg8Ph6h9TH2qdF
TLSH
T1CD955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 42b7ed2e8a04f21c3e4ed0515679de5364d1ea703f49c29ae263a1ced2e0382c
MD5 fc1b50bd71fb978ee8afda11f5763f41
SHA1 42e89f9a2bd7cef37e92b047154fa0c86887624f
SHA512 ab85dbdd6958ec5f5c46d65eddca73987c74427171cbec67e020cafc1ad32a5ab3913e06d66cd3cac3db605ed75dcfdcacbb4514f0dc51a6f42fb8b8bcb68879
SSDEEP 12288:IlYJeXm5nkEUuELk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAo:IlYJeXm5jUuEL9rrHbVti0VFAguFqAzG
TLSH
T150E4124D66EC20E6D62B41B989E20105E372F8B01351A7FF61D0D1B68F7BEE22D79E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 c0155d053f3ff366c49cdcbf420b7dbc9007dd59b1b744bd84f19460db174211
MD5 d7ee0fc1a4d4eb42f9aabdedc28db613
SHA1 2ee7ea48a9937bec612bde5e62b37179eb94e616
SHA512 c27d2528d1cc7551b600487ae0f915243dc6eb38d234ed23eb9bfbba96d62eb97b0af0040c49d5fae682d457d5d3718de259be1ad596ecaeceaab30e6eaaa15a
SSDEEP 12288:7wu6kyMk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:7VtyM9rrHbVti0VFAguFqAzWdRf
TLSH
T1DFF4120957D850A5DB7606789EA34055AA35BC605F2096EF61C0F27F6F3ABD0BCB0F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 8f3f1f6cd393b01eaa0736fdcdb1f2e599a2233e4ead866363eac84040cfd3b3
MD5 8f93f55ab1ad4ca03eb4a3c929ac7aef
SHA1 f2a585f37ef2e7aa335d3e1bd81c6b816ff99ada
SHA512 1faa7ed9fff217d6c0d36cab0f5842bcb29d224bd698927b625846277496123df4e330e1230f530077bb733fec80f8b9aae3036f0b2851707d26a5f39e386a3c
SSDEEP 12288:APbk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAvA:Ab9rrHbVti0VFAguFqAzWdRf
TLSH
T110D4234E46E91067CF1702F45AA72012602ABDA45760B8B3B1C0F1B2DF7EEA27CF1D65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 079c4f899592aad3af1f54a4b3a58adbd5ba67be2c4af6b0511d4c5ee45b5f95
MD5 b48d2d099148b69b530082782546f385
SHA1 47f6bb6461373d14ff2c0ca9f1f43478fecfd8f9
SHA512 412728272af3b5367da88f820c34a740fe6095ef6c6d5710898b25c551d69eaa9a2a64702fed1c1d9d73f6218564eec184fd78390d04b963f166a77836a425b4
SSDEEP 24576:2C+TyQIu93VAumZr7jmK9rrHbVti0VFAguFqAzWdRf:2/TfIq+YK9TH2qdF
TLSH
T1A9558C1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 9ad98daee3ba4109d375a31d43f05d050747b6b917e1e2eaabab0d949a39cf95
MD5 013aad9436a8036a87b95e627b382be6
SHA1 ee416ae8fe43e5e6446af91c70adf17ae600310b
SHA512 e4355dafc37015d84a517e85b031b41bc95ee2d6143ea2527ff8c722b1c2dddbf97be560365ba630fbb162acd85b885185041a9afdbef9c6c42484811a119bdb
SSDEEP 12288:fcyrWOstaa3kcs/k6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAo:mLQikZ/9rrHbVti0VFAguFqAzWdRf
TLSH
T1DCF4F10FB3AE00A6D5A7827C88864102F67378705712A7DB5290C37A4F7BAE5BD78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ed3a48270c106d4f2aebe750e74107ef890d60952dcb83f42d4fd1ab6d80dc85
MD5 0f607c74a884c696bc08401e42e7dd49
SHA1 3fb5d3df5c3b8253cf005f6fca71575c9a4ebaea
SHA512 3b7d51b994d78337abbcfce15e953d8644bafc1fa461e55ccfcf636f4e6a24fcdd3559eb2d21d49707b3235e8ff5d99138cc70e243586ad980c1ccedb9c2d74a
SSDEEP 49152:gpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPM9TH2qdF:RpC7b4+80GTkp9TH2i
TLSH
T112A57C3DE2F810ADD9AA8375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f1d65740dad7dd04ee9f2896dd7817845e5ce0f5a6c1b02be0bdca78eed38ecd
MD5 68f6f318b02d747080c7159130994836
SHA1 ae6420ef98ad8be1f26bbb252d8fa2f98e8ec0b7
SHA512 2af0dfba4c4e0b95f9e0ee7c25b76916e861db3e42a8307a991b1b937d52bf3f3c3bf7f0d0d077bbbbce060e3c3c9f2c259e276b3815cdefe41cce7167a35106
SSDEEP 24576:nSAwJPE1IDAo+4Kt+l4413lUQE9rrHbVti0VFAguFqAzWdRf:nqPCIo4Kol4jQE9TH2qdF
TLSH
T1E155B01AA7F946E5E17AC7B4DA63C101FB727822133163CF9290817E0F16AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 603431be58eeec362cc86068cbe891b456b4d726a0e556d199b1e4ab692b193f
MD5 8e15f570f0e16e8b759e624da4d78f5a
SHA1 e8a9b846b06e7c03d745c8370bd2fee1fb050642
SHA512 1af4d2367bd531b5bf3e7aad07a0fb758680196050ff45689b5e0a074509af46017279e13ecf4cbdbd238b6d7cc646909585df559a6161ce6c63366cfc006bab
SSDEEP 24576:fyLXPLcT94t09rrHbVti0VFAguFqAzWdRf:fy7Poqt09TH2qdF
TLSH
T12C25E02ED6AD04E5E57AC27CC6A38506F6723CAD033166CB15A090762F6BFF46939F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 5c9fbd97939b3d47f3bdaa7809e071d1f781f83f8fee3b92f315c7eb8c0b5acb
MD5 38db831b1087876b64a8a83c4181c587
SHA1 17b5162defe33ab2857541045cf8d03456e98846
SHA512 9862bb572fe85f3a1edbf406bd7a9c221fdf7c008829a22f7a8cb1f134b9e40591b086c39d104587bad84a39a45b136e13041022c842e7973ae4d35da5e40948
SSDEEP 12288:q9lyvj3IkxjbBzPk6yGvrCA5FV/birDqnbu012N4FAguFC/0hzW2b0KSnNuswBAo:qWv8qjpP9rrHbVti0VFAguFqAzWdRf
TLSH
T109F4124E56E824A5E53A03B4DA6740269072BCB11364A9FF71C0E1B74F39FD1AC7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-113-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/8-170-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/664-374-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/664-162-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/920-77-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/920-82-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/920-75-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/920-157-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1672-115-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1672-418-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1672-181-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2496-443-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-458-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-450-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-447-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-451-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-454-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-452-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-453-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-449-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-445-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-444-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-446-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-457-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-442-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-459-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-441-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-440-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-439-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-430-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-448-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-431-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-432-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-433-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-434-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-435-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-460-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-436-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-437-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-438-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-429-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-427-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-462-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-428-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-426-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-425-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-424-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-423-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-461-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2496-463-0x000002135CF10000-0x000002135CF20000-memory.dmp

Download

memory/2508-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2508-158-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2560-87-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2560-161-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2560-86-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2560-93-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2932-151-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2932-67-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/2992-2-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/2992-8-0x0000000002320000-0x0000000002387000-memory.dmp

Download

memory/2992-74-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/2992-377-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/2992-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/3004-171-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3004-419-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/3260-101-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3260-103-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/3260-107-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/3260-165-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3484-219-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/3484-182-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3484-173-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3484-420-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3484-185-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3484-201-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3484-179-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3484-455-0x000000000BE00000-0x000000000BE08000-memory.dmp

Download

memory/3712-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3712-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3712-70-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3712-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3712-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3880-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3880-38-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3880-32-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3880-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4388-51-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4388-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4484-341-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4484-141-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4484-145-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4484-135-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4572-153-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4804-111-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4804-16-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4804-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4804-26-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/4840-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4840-100-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5284-357-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5284-148-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/5412-257-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5412-130-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5412-123-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5412-124-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5504-225-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/5504-120-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/5824-49-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5824-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/5824-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5824-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5836-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5836-375-0x0000000140000000-0x0000000140216000-memory.dmp

Download