d20646bb55aab101be4e96ff5ed66034b56b6e9be20bcdf3a940eca8fdd086b0

Analysis

max time kernel
148s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Size 4.4MB
Sample260529-rt2bjsdt5x
SHA256 d20646bb55aab101be4e96ff5ed66034b56b6e9be20bcdf3a940eca8fdd086b0
MD5 04d3093842e2e34fbac60fb88b42cffb
SHA1 2b26a55796e2251edd4e37a1a2f491b63cf6c514
SHA512 56a82ac22db5371973c4f4caa4092c000430aecd23172bd1730f170c95726c25cf64fa2f3637e1a0af6bb7dda2d9d82bcd3eb1b5ecdc9ee926062df52df186c9
SSDEEP 98304:8guneKaJ6HtjE9gzPhLQRWt1WZCmMbg5AANGgUoqxvS:8gUayzMMbg5AANSo46
TLSH
T1CD267C633AE1762EC512A2304D3BF77DB2EEAB700A3541D773DC6F1A1BB11416A14A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
1348	alg.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
4936	fxssvc.exe
5024	elevation_service.exe
2080	elevation_service.exe
4912	maintenanceservice.exe
3472	msdtc.exe
2088	OSE.EXE
948	PerceptionSimulationService.exe
4956	perfhost.exe
3640	locator.exe
4872	SensorDataService.exe
2144	ThrottleStop.sys
3852	snmptrap.exe
3132	spectrum.exe
1752	ssh-agent.exe
1596	TieringEngineService.exe
1552	AgentService.exe
4948	vds.exe
3764	vssvc.exe
3252	wbengine.exe
4524	WmiApSrv.exe
3584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\adfeba42c9945a43.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180281\javaws.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003988e4b077efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a315b0b077efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068f06ab077efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6cf8db177efdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2526db077efdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
3548	DiagnosticsHub.StandardCollector.Service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe
5024	elevation_service.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeIncBasePriorityPrivilege	4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
Token: SeAuditPrivilege	4936	fxssvc.exe
Token: SeRestorePrivilege	1596	TieringEngineService.exe
Token: SeManageVolumePrivilege	1596	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1552	AgentService.exe
Token: SeBackupPrivilege	3764	vssvc.exe
Token: SeRestorePrivilege	3764	vssvc.exe
Token: SeAuditPrivilege	3764	vssvc.exe
Token: SeBackupPrivilege	3252	wbengine.exe
Token: SeRestorePrivilege	3252	wbengine.exe
Token: SeSecurityPrivilege	3252	wbengine.exe
Token: 33	3584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3584	SearchIndexer.exe
Token: SeDebugPrivilege	3548	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5024	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
4776	2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4492	3584	SearchIndexer.exe	110
PID 3584 wrote to memory of 4704	3584	SearchIndexer.exe	111
PID 3584 wrote to memory of 3976	3584	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_04d3093842e2e34fbac60fb88b42cffb_amadey_darkgate_elex_luca-stealer_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1348

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3732

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2080

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4912

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3472

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2088

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4956

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4872

C:\Users\Admin\AppData\Local\Temp\ThrottleStop.sys
C:\Users\Admin\AppData\Local\Temp\\ThrottleStop.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1660

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4492
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2796 2828 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1012 2824 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b3b5c2df1839702916a09d41a390fb51c4b47c7749810b9061039e1fbbbd1318
MD5 017f27dd9e327b68a7bca23cda23f1e9
SHA1 3f6c7caec3726fa328086aaeea37639a30dbeba0
SHA512 b7c096bd418a5d4d47880ba69d8b025f47b2e04184dd00e27b4b2b82c4b09638edd2bb00e446333cfa2d6a11dc57b708727fc5c67061d0059b867a71503485c1
SSDEEP 49152:0b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnMLw9IXeQWScvSH:u3q6mjBBUoqxvS
TLSH
T16CD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 43beeab7e3fc7f4d6aefee04c0da75539f64a787b68d8929ed74372dc497d3c6
MD5 13916b7ca98ba6faae93339ffe82b4dd
SHA1 2bc2f3fc08926006a8c9e2b98ce352ce76ae91b0
SHA512 4931f13a8287ec9f4ee881b4452b83c26a8883b7a79c6e41999758590230eff5e506d72dfe41432209760f6c651bff01730b5580fea9391bd8996cb4b18b836e
SSDEEP 24576:lXYfDtczAtLwYReOtjfyJk5XeQWScvSj:wtcWLw9IXeQWScvSj
TLSH
T177050129A7E448F9ED67823CC9A28501E773BC4447B0E78B03A8996A1F337D85E3D751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f1dd6dfc7ea6202a181a4163def27f7656f464a51c9c021d222611f220a164d
MD5 dd365c1589b938cf565dc4b79450d50e
SHA1 7b599911fc7104c417bebe1c995640891ba7228d
SHA512 b4764f67d4e95972ffadac7d3f51ee26d79d88729634c3cce197e2b338288b10117a1aa6cca46e42f8beb81a1bdf7391ffdc5eb8bada6f26acd367e937932354
SSDEEP 24576:Z0Le5ji0hmxhrMULwYReOtjfyJk5XeQWScvSF:ZPji0AzDLw9IXeQWScvSF
TLSH
T10A35AE16F6748331D073C0B9C5D2A68AE97234855B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7dddf95a8d3382fb226d17ed817d783aeaa29cc9060071b15fc9014e16ba776e
MD5 a1b3c24f5eee8c4ca6a9b9db3028474c
SHA1 1feffda639c2ce62c5b30201e64c93c26d21e3d1
SHA512 fbacdf1dff6d65b00ed434d68a482a87fadb6e320aa23e4a64376acadeca9fb9a55d051c0ab11047e4ad03f650877f5508887b3cdb0a5b1157a4d942e6b59147
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyumLwYReOtjfyJk5XeQWScvSM:n/ezSC6vUzPv+HjyPLw9IXeQWScvSM
TLSH
T164755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5247376d76f50e877fe25ae947c8c6b2e8886dd27f3395c6e625bfcd5a6409f3
MD5 a9e4277bf39ec1e9e2eef2ddc34e1b6d
SHA1 c36f289a03071834a08e5cfbaa46a54e41ae3a53
SHA512 2dfcba924139d9a56529b87b6db88ac551fe2bd3927dee5457dbaf51ce797e2d207294b58f18901cdd988b25cd431cfda98058349c0f37a1ce870f0ebd19fa92
SSDEEP 24576:tVbqPb88hv/l+BRLwYReOtjfyJk5XeQWScvSZ:tVO88hXl+jLw9IXeQWScvSZ
TLSH
T14F559E66F5748331D073C0BAC5D2AA9AEE3234415B318ACB1246D76C3E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ceaa4e41efcf47884e83487446796e0ee5c937eceef4dc7d4c2c9ab2a275dc2e
MD5 0a90b7337f7497b67fda15cfa6ba576c
SHA1 74299283b4196993f0a1994a403c13f438e1baba
SHA512 8e5e0d0b7cea593404abd064bbd6b590f0db450b5e6fb3de18947bd09ca4285715365b15dbf0b8fe7fd6765576926377ceaafc505fc6e52f898115cb8bdc218e
SSDEEP 12288:oGoL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSw/:oGoLwYReOtjfyJk5XeQWScvSW
TLSH
T1D7C42397CB69E072E7135A3452A959C1A362DE88C4B00217FE3D77EFA5309E8CC643B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ce07c76be2082a53f6ec9cd7fb9a45946671c5348b1ed1c5e4eeb4230c7bb6a4
MD5 14c583b730546f4ee30df9e2ccc66b94
SHA1 df13c4de2eba2dfb724395466e55cd6f88a02154
SHA512 08570cca06ccc6129a2bbc3f1b655bb14a3bc98b3af7a14df1edbd69ed985482242e9bcb835a8cac40e1bfe626c615c39c56dff00a458d4ac2f4c634ef1de9cf
SSDEEP 12288:SeBNUbTVO86U5L7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwA:SJIU5LwYReOtjfyJk5XeQWScvS5
TLSH
T19705CF3BEE28FCE2C27A8D7857918640E77278704B6193CBE179830EDE235E45D79825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3eeffabb29d42186b76a3c853488c34ad5f23514c0b9907b09f5701adfda4c32
MD5 75812997247857c3abd7c564382afec2
SHA1 4a115862c221ba7b8165ab457f374da3e6063d9d
SHA512 1bbff3f0aa2c8035a8c1b0451b0d93301f37cdc0e0a7d567987011884343ad3dfbf4b3abe19dec173862d60088a6ad26d40108ba999859ac271fdb0f81195c3f
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THk:tQvGAdlCEL8c/WRNw5C2UoqxvS
TLSH
T1B9267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 5a97f744ed117522fd70802a5c333ba05e30040fb6318a3e8d5e171d8b9dd576
MD5 9defe4db493ca42fc3217cea6b751f2f
SHA1 ee85559370e257bad0eec6f39531910361d9f232
SHA512 418cfd4cdeb880ed0cf583e558ab00c551c5d1a160659115a3c40b824f3c36f572a23c56a0050decdbdbed325ba6e2255be892a69fb20a5d74c01784b025b864
SSDEEP 12288:5AwSfxL/2Dc3mDLLmt0LDQewsAjTL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwB8:qfewsAjTLwYReOtjfyJk5XeQWScvSJ
TLSH
T18015E031FE74E032C37B0DB61B26C706547DBD604B611AC3E3A89E9E59302D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3cdedc3602c4b50701f2662bdf1119e4e4ddd12025f0aea61029faf354b0b8a2
MD5 ba65185945ec9e0deff9a2bf66eb7d14
SHA1 6e8011458d56c27909dec96413c8940ef32cc7b5
SHA512 6a7a833ba265cd80d457ef7afe7ebd96b8a98781cc341d236d4d22e0fb6dbd1aecc579d0fb4f33e544ac9ce2448e78c68405fb555d68b2eaba90e5a8ae90e5c0
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHoo46:XUEtQevvqc2W1cpV20I32z
TLSH
T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d106834ff50d060e3a8751aeed10ed69559ca8595a64eee73806312e85a5f812
MD5 5da4425da27e4c14228e1fb2df8b6b26
SHA1 9efd2bd770e424855f11a3756118fd3ad6849784
SHA512 5dc3f42b594b7e296efa3a6427f3d73e59c300c44f6a8c8f194edbd5272ee89d8f823ecab97bd4717a9873220505690d52e8f0d0e5b8e82caf4e8418640bb733
SSDEEP 49152:fCbRquA/m2yL5zQfFiV+XenmE3/zzLw9IXeQWScvSQ:4oqtVjnmyUoqxvS
TLSH
T140D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d2feb15e7e90c56dd72b25c07ed1d8cdde56cc1a7758aff6651c4e66eb419273
MD5 564971aec0279568cdfa305d0e1bd100
SHA1 367d84a926a2f772e6e247e6a77b0fedd36654b9
SHA512 76cce976d04a6e224438fa29e5fded71b04eead62e0878673c61cec0999a82cbe3b66a63c305ba0c41c1c2c84917baf06b1aef1a9c45bd2103892da979821502
SSDEEP 24576:XAhGL6IFoiwtA5l7S53SLwYReOtjfyJk5XeQWScvST:XAM5Foiq5CLw9IXeQWScvST
TLSH
T15735AD81EBF955D4F5B3AA7899B68171EA76BCA95E30C20F2160D21F1E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 dfd7f791c514de72ce9a5c88edcc1d39f4408c0a116b702e7fc776278b9e36c9
MD5 00b11db5110ee3349a03ea8dee3640c2
SHA1 b47b222a8ee840f31c7cde2a9bcfa0d37336d201
SHA512 e6b9ab2ab715ea2360e6946c7a2f372884f78f7d71183623a123cd3cb7f4e99fd2c549b8fd93343b0e15f7be9fdfe580833572189a6d511af2a3ad631a72f6fa
SSDEEP 12288:Omw5HEjsChNEBFgl0WDm+CGL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSw6:HwuROWvLwYReOtjfyJk5XeQWScvSX
TLSH
T12005F14677A45CF9EA6382388697C536F7F2BC012A30C71F5B64C65B6F33261AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dbe183d31844c192c827071caea465e64c5a763eb488b8c84ea8212cf37ef29f
MD5 0d0b3c01ed236b0e73dfd52ca6dcd4cf
SHA1 36f5666963766e9c23a4cf29f536276672aa64a9
SHA512 7d23dafdc5e41104fda650f30dbf40b84068489c036f9a51a144a74c703b37c983aef018ae71412c323109c597d02c8104f665120898c12a55f8099211516371
SSDEEP 12288:dyZ1IyjL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwX:EZucLwYReOtjfyJk5XeQWScvS+
TLSH
T130E4129A63E4A0F2D253523CC9E55A85E372BC55577003CF6A2853AE6F32ED58D38331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3876d83cad1cd892ccf5935fe5523d83a9df95c2df5004c3f92a5924110b0de8
MD5 b5a6fd1402d20e3a0c380b04a6806deb
SHA1 3815701c1f83a90ecfa384198163aa3a991074d1
SHA512 41d3f34888532aabed1f4b6d7eff09ebcacd8b3ee5dc1e52287df738c1c1b1c59666cbc7c0997fba98befd8ae288e6670dbd05dcb77db9d78716dcf57ce83722
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uz:gQRQyi36YOcPDLvw2gAf+PN31UoqxvS
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4271a81cbbfe7e2a4e0b7cc8ea5ef22a7157b8b85c93add6e15997b392c86192
MD5 0b2128e0504fb76574f0dfc90762c0ca
SHA1 06d31912fd68c6a3f432d565edb2a1ccf14750be
SHA512 39555dd7e7b0e11de4e72a4ecc57d0132045d88a64c5a5bf712906b237831237f185479630233e77145a6486062c02f914a40b9e70eaeebfd2e8398f73c6c739
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U6:hQRQyi36YOcPDLvw2gAf+PN31UoqxvS
TLSH
T167667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cd025fd3d57ab411cda188ccfaf98ebba7af968e8449b87ae1e5aae7cfebef38
MD5 ebf6be1a7d1ee0171b3695f93a2fbbeb
SHA1 769b70a50a6164d3f4e3616cd8e69e647b004b8b
SHA512 acdb4fef2ca28b6f82992b6d9444d2f93e6713c48db0b5f1adc1567ec7dea7c2ed62a0d2a6a6ca54d3cbd3c7343a76a2b2d878eae79ed33cf10b0449f6060066
SSDEEP 49152:Y68Qg55nhkeWu7PNU3/DLw9IXeQWScvSg:ithTRc/DUoqxvS
TLSH
T1E4B55A33B2F600A9C44DE1769F4A872196D17C75CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3d2bba6f5fc2f5d671707105cbeb436114b4187a13f36a95f096571d12394757
MD5 035737de57d24f94bdba1b7d7b42147c
SHA1 30b989d40dcbe27d4188bbea5548292d96a99a58
SHA512 3cf793ce84581332d258feade66f01bbfcb3810c2760575b12da129d8aa69a014f64f47dd49be7ed678e09e7f6df08c399756003195cde6bd9ffb6a2430bc52a
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99T:ry5112gYy5azzVvU69nLKnhZoUoqxvS
TLSH
T1B9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 25341bac0f49baacaeab86e33dfea0cf590b96cc895c21136a3224ad6ae67487
MD5 b35b660ae83a6096ca5610f58287ab60
SHA1 29d6edbda66321022d9fb1350d545433daaeb7ed
SHA512 095ad6ca41f2d922646b0c155a7c753d6a1d8781e662e9b87659d033245f65c4059690c877e5a51143d6ce7b58cab8aa8da9b57145592d9eb33bf58a759ae93a
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gldLw9IXeQWScvSl:Xu6JmIxd2ddUoqxvS
TLSH
T187D59D13F1DA01E8D05AD578974A9233FA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c4629023552722e1c13d57ebd3ccad5734a1096a101998a4965206c3f816ce7b
MD5 31ad985ecfacaef37b253a9180c9b07c
SHA1 3a98fe58e8b9817a4b7fe84ee8bd5fceed7fa813
SHA512 ed78ec7f26408058f8f74854bed91f9c2111f4fcd86f8e6e656d15d21c6b4b248c42d7282404ba5e448895ebda866d5dad12ce03340ee732574ec6ec3fc91849
SSDEEP 49152:C1hpsNoJpF1A67U44CwH7R4xZLw9IXeQWScvSe:CmifPqRyUoqxvS
TLSH
T158B5AE13F2D901E8D06ED17887569632EA62BC450B30B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a6b7d6de5118bba087856b921231191c1f2ecef740e047a8cda057bc6065c77e
MD5 6fd837dcf50e1bb58539ce9af661e6cd
SHA1 572a491ecfb57612f4987de6734573163a9eacf5
SHA512 51eabda92de47abba48496d7ed6a2919e2d055a4f9a69bdab9454e0e65353b3c5a9a2f8d21c4806665d0f53c7f4bf54bd800544b8c6d4ea050a13b3776e86d04
SSDEEP 49152:vSuZQIY0Be2KkRVtOnks6NMHqcLw9IXeQWScvSa:V5dKqi61cUoqxvS
TLSH
T194C5BF03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9bb1e320368242f6a0a9cfe617596a69783352e1c4e4801ceeac65be12c015e8
MD5 15be2a199694fc47e8f9bc56db6323dd
SHA1 258b077edd77aa510e352d69ac8a0d07a5ef0dbd
SHA512 d135cffd55505c0ab76195fc7df28fd95a3539c011c0c893d8b9cd49f9b2f2c20864cd98c5f653330ee609ed948d2db7a3688f23244f7f6d85dfa83e948356aa
SSDEEP 49152:8htSn8EApI0figjgiDn0AP5wtLw9IXeQWScvS0:9X2iWphOUoqxvS
TLSH
T1B395BE13F2D940E8D05ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 002b70db7200fa91641bc5adbbb0934d90daba2a13da77fd6a4c712defe25aa7
MD5 146cdca4a2df831aaf0e58dae21c087b
SHA1 dcd3125c6f5348e4ea09f75eccb483f074fb5750
SHA512 352dc5c5012d1e0ee1021edae7d22596e61139c0effdacca40e53e7395fbda47f8512e5ea83985899e901e9d718980d377570d009ecb89ba676ea47072802fbd
SSDEEP 12288:vQL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwi:vQLwYReOtjfyJk5XeQWScvSj
TLSH
T129C42387DA6AD1B3D3035A74839959C1E2A6DE8CD5B00117FE2D726FB6309E88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e0b165355eb07b6a376cf24b9166219d26c0885c5713b1e565f37c9c31a6c736
MD5 4a6aaeadb96e42b0b154b374a8af9a7e
SHA1 9ee856bdafbf557dc2d5a98f02d1a9260a7d7ec5
SHA512 43b459ab38809bf11353e39782f1f0a57e62239fb31cdb1e04957ce01066ef954ed104969e66de126f9e65af4f816c36144f73cc5c0ec9a6394471e2bbc2745e
SSDEEP 12288:/nL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwi:/nLwYReOtjfyJk5XeQWScvSj
TLSH
T1DFC42397DA6AD1B3D3035674839959C1E266DE8CD5B00217FE2D72AFB230DE88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c957ca8f600d54932f417d1e4511554aac7624af8683a3c5cfe8a8de6117f66e
MD5 5d1ff4ecc89b253645cc6302e428e5a5
SHA1 4b24cd1e208fce20f0c15ecae6ebba0098cebb2d
SHA512 d060a14f6b4c3e1cf3305b3e89d2c273d2d3503c383685a0b67225b1840bb02849c1db436d77c7c11da8416be09103e31794cd7d4beaa78da43abc3fc1a29364
SSDEEP 12288:iBL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwI:iBLwYReOtjfyJk5XeQWScvSV
TLSH
T1F8C42397DA6AD173D3025A74839959C1E262DE8CE4B00117FE2D726FB630DE88C643F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 0b347d71a9bb369e1bffe9dea92f9ebd2371884216c8fede8a29a219ea3cc944
MD5 614873e5dcd87b2b50f397dc2d37d9fe
SHA1 d82181ce5330b1c5e15cfe39d2921766eeb0aa12
SHA512 340d8edadec6060b5753e7c9d2812b10bf900756a48082bd8245ac1ae4ad35e0137211e910e97811d1bed60d0da485d8822d371c53c6fe8f9dab739e5fb007a0
SSDEEP 12288:sVyL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwT:dLwYReOtjfyJk5XeQWScvSy
TLSH
T1D9D42356DB6990F2D6139674C6A555C1F3B2FD88D670031FEE2C269F6A30AE89C343B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 79595a7468a2f6bb980b4c722c966ab98675da82ad5557bf4450cce41c531bb0
MD5 3c88d2da0de6338c0147ca8caacdbee0
SHA1 dd74c91e3ad31f781baa7955dcaa64e3c3ddd065
SHA512 0f08330366b784da5cfdfa86193ad7dc058e856ea3029ec42bf8e77c29ac5d2e5bf22590e71c872497c6d825d66ef7c6a4f139b52c5da21a1ca419586637536d
SSDEEP 12288:9KL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwW:9KLwYReOtjfyJk5XeQWScvS3
TLSH
T1F1C42387DA6AD173D3035674839959C1E2A6DE8CE4B00117FE2D726FB6309E88C643F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1ceaca04ffb13584fb0830d3744564440c9fe7ea49ec17827d41be00ae8e0cd7
MD5 f946be05fc1babf8876d85727077f0bd
SHA1 b20db9d0811937a26810c0690312d081f004800a
SHA512 86b3bda2c29a51c7a7ae527306a0fbf4410b9d549a10207e8b7bde973b115476a21d40e879746c76cf8a2b3e804241f05aaaf6f26186ea206026dd665fdf2b0d
SSDEEP 12288:l7L7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwW:l7LwYReOtjfyJk5XeQWScvS3
TLSH
T1BEC42397DA6AD173D3035674839959C1E266DF8CE5B00217FE2D726FB2309E88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a162ac6dcc3c84aa0d4039c687816cf3fddbd32e8ada744f04021c62d25f7048
MD5 144ed104500ba97208c6a01e82a28e07
SHA1 aa9b06fef68b6d2e2d04dac1f3e11c7e951f955a
SHA512 7a2def9691756519c12af9907e684fae7b9b7637f8a76675c27435a8285315d2b26bf77aa8bce77e8c7a14b3cb0dae652d4d8a3c4d255ed244b450ee6b80bf76
SSDEEP 12288:7fL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwx:7fLwYReOtjfyJk5XeQWScvSM
TLSH
T104C42397DA6AD173D3035674839959C1E266DE8CD4B00217FE3DB6AFB2309E88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 dc905926d5e18c316a3da5a4e16e9101c8ac0237e4bed81b460928b5c7d4c621
MD5 854a4d0913ac086ca85d216d5599d91c
SHA1 84e657f8fedea4b83bb412107c7b3001d9d5a9cd
SHA512 c723daa16fa403d81144193b8b915acae86e9740736a77f0b81652af62a9a7001247b71c0fa311a80ed7888cdc2b63b23dc36c14d1798df3a3d673372c6279b4
SSDEEP 24576:WZM3zFVSOHLwYReOtjfyJk5XeQWScvSW:WZM3zfLLw9IXeQWScvSW
TLSH
T1A6050295B39058F4ED63823EC9658946D2B2BC594BB0C61F17B8366B5F333A00C3DBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 53c7628268722ada5bb5411ddd63a676badd7590d283e2a10d37428213e42ba5
MD5 cf8f535ff2bbf5489b1cba53a7f1700e
SHA1 84b5760ee56edce4aba428513e7a54a55910967b
SHA512 ccf2dbe6425bd057eb602deb9bd2fe2e2ecaffa39822782ad658a46565aefa099954ca9dd50ed5f24e5fddd2aa18bbf978831bc2e678d496b3a68cea7149f200
SSDEEP 12288:RsL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwH:RsLwYReOtjfyJk5XeQWScvS2
TLSH
T19DC42387DA6AD172D3035674839959C1E266DE8CE4B00217FE2D766FB630DE88C643F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 36dd8cf3abde932eeafbf5b33bce6b2b7fa977ee9a402e19746c793e59bec7f3
MD5 f89bdaf470b2f6e89142ad4b27ec0fdb
SHA1 668f9f88874c64a179d222d790a4f0cec1205db0
SHA512 d84485976c66ee4ea6cbb0242df0f65c42cc2cf4324209eda409ae977c5fce0a971dec5dc8224f28d3786cd948ed6d8d9190358a017c7818b5249c1e7c48ab31
SSDEEP 12288:v4L7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwq:v4LwYReOtjfyJk5XeQWScvSP
TLSH
T1C6C42397DA6AD172D3035674839959C1E266DF8CE4B00217FE3D76AFB2309E88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 98a463f1cdbe2ec7edd7f709b57832724dd3c0b15b310a4bd9e0afe12b30eb1c
MD5 45b7e95f2325690c409f6fc5af7c9f4d
SHA1 62190930d57d81ef9c8f7d60e4859576e12c8c02
SHA512 0e238ac96d40f943fc06a852db2209c6f5253924597be386cec8d54587d6af37dc0865adc4a38f9c8db5ddd3dd771ca503169aeeb3ab79c4d01d24d6dca35868
SSDEEP 12288:nyPz5L8jL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwg:KzyjLwYReOtjfyJk5XeQWScvSB
TLSH
T11FF40247B7A570F5D223823889A21A42F372BC3547704A6F6B68577A2F336E09D39770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 56d166e83cf7faaafb1844061dc51d821dcf2f307321f0644ca8534d7c0a9429
MD5 02e80002ce2a62263b89bc3189edef9a
SHA1 18bf8c6f86675f101c43ced1b5dbbc08150fb715
SHA512 d93056cdb3e9a638c83afeda301a5b36a425c022ef723fe803e72a93e6c96153bc28c88f9bd9092390a8507bf4bb7b219fb07969c92d740965cbaf2ef5eb18bb
SSDEEP 12288:DsL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwl:DsLwYReOtjfyJk5XeQWScvSY
TLSH
T138C42387DA6AD172D3035674839959C1E266DE8CE4F00217FE2D76AFB630DE88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 96e489e15bad662b2513eae4f0368212a19e81a18a0b6478df8c594a9e4557f3
MD5 f2dca19f6b403a6508a2b67ad450cbf7
SHA1 ffec66107b5272b0960078d37b741948ca031f1c
SHA512 6159153ab37c5c8704c958035bee8800d923d8a51a7e155b01e3f29e69f14c1a67c823aa8ff333cea231b54ae7cc122065b181340f2cd54ae0fdecced8a05800
SSDEEP 12288:jsL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwl:jsLwYReOtjfyJk5XeQWScvSY
TLSH
T1C8C42397DA6AD0B2D3035674439959C1E266DE8CE4B00217FE2D76AFB630DE88C643B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 07142ebbadf7268f2e36b81c02623cf5309d26fb4b13d6ebb1b88a37385711a5
MD5 58c78058c85022559e6571da616474e9
SHA1 1c38804117c34dc44e94dacd63fabab516e053ac
SHA512 cad319497cb15eb7f8b22fd224de26469b3fe5c2c473d6463dae6b4db13a28645c8e5fcd870d7ef7f2cf876f5b0cfb93883c9243f95646c3764ec78c43ef0550
SSDEEP 24576:iCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAlLwYReOtjfyJk5XeQWScvSF:iCUAPTY+8Wg2lIL8lrIUJLWwKLw9IXeg
TLSH
T11465AE1EA3EC0896D4BB81358A518A06EB727C2E1B3196CF2160C37D6F27ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 62b7150c707ab56346ad400e33977d7bfad9b611ece2112dfd6973ba11741374
MD5 e183636049ea6ac7a5d3350e5f207d90
SHA1 7c5a13ba405c8c13b5f6257434d60fd110a89003
SHA512 c11e916c9872eb4f3469e0c65495e1249b4fec7be596dad0ede9a20aaace8766ff48f9f773fa2e2343ceffca067c86396475db5c20757e408685938fca1a7c64
SSDEEP 12288:mpsfcL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwk:vcLwYReOtjfyJk5XeQWScvSh
TLSH
T19EE4F04AD29842E5C12E6238C7564A81F3337C6887F093CBAAD4F57E1F326949DE9353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThrottleStop.sys

Path C:\Users\Admin\AppData\Local\Temp\ThrottleStop.sys
Size 49KB
SHA256 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0
MD5 6bc8e3505d9f51368ddf323acb6abc49
SHA1 82ed942a52cdcf120a8919730e00ba37619661a3
SHA512 c547ca802b74b93c455cdec1fe184e1d64184cddb9681b920120bc63b6c4285137e892910c9f069d35eea61c8da5b5672bbf72ea88df352d4d84e3d4094b7924
SSDEEP 768:NtYC8ntVFJD/i4iW4cTzmwi28O3zuv2fT8aKgrEfp33bcmKg:N38tVIdQ3bT8aGftL/
TLSH
T163334B53DBD81C82EDB79E3061F4DA377E34B2869A30D69F012DC0550F92BD1AA2D369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ff45f1621c13cb2d187e95498e2d365d609be38ffe373942d3c4eee3c88c329b
MD5 5ba1c922da909a551f6e81bd1e3879dd
SHA1 b0f43fc95ebc8258411dbefc7b3e357571b821f6
SHA512 446dda16893ab00e1f7a116bff3f082de6d7334e829ae0b9cd58e516a861a8aa28acd2df945a27404b4ca247d8f7a07e3052d69bd5cd3443326bb7b85f9661c0
SSDEEP 12288:0hL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwI:0hLwYReOtjfyJk5XeQWScvSJ
TLSH
T187D42352D76DD572E3235A3442A99590B36AEE88DBB00183FE1D73AEB130DE8CC74365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 124f226258ccfc622d626ae97024efe8584d78410cd68b54d7c06619e341e6ad
MD5 be04944d542e5737238f027b32703158
SHA1 0dc91c98960f1505e3806b92cbd9d9cb25cc9a03
SHA512 4afcfb13aa39d475c1f973c7a366a859211c117cc798fe869db345766e0c83514749e0f8ef0cc35dcabe94d96ea5eef49d490772f14693961da288b5b147cac9
SSDEEP 24576:h8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCzLwYReOtjfyJk5XeQWScvSf:+RZwQCyiHiQEaaPnM0Lw9IXeQWScvSf
TLSH
T1D285AF1E62DC46A5E0BAD278CDA74407E6B27816573193CF1290C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 f7a6b173589acf725840285ffaebc3b867fe81c3be2b79e83e6a66cf522e2afb
MD5 2f32147434cefcff53f5deb785e0a377
SHA1 9fa408c34a021cdf9731e7222c79490c27811bde
SHA512 4f6b4d1b31b7cbcb406f1d1f71148c0ce561cd5fd43173087ec666565850ff561bcf2e852d452db0f9e362e3eb3310eb5399cd3f8dd457a23a4c92312d83f91a
SSDEEP 12288:abxA1U7KxL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwZ:abxA1UGxLwYReOtjfyJk5XeQWScvSM
TLSH
T175E4126E96AC24F1E232A63C85D68145E332BC19573053DF6999837E1F33EE89C34B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 52715a2a9a0f1e4cf7166ecb619cc1ca717e3153772cbf3487ec8e541d0c00eb
MD5 e16b466cb0b6c3363e8865c613f207aa
SHA1 9df8cd0e6fa352a87730ff4ef4d001334b40bc95
SHA512 ed7f393bc097c9fa0464210beba4e34e72d18efba34ddbb88b379cdb13eff7ea4e87549e64e06b2a4bec761ce8b95c42285ef98802b4d5a8afdc4b24ec5aaceb
SSDEEP 24576:8jsmP0yHaqrVqHra44KDzMsrnCLwYReOtjfyJk5XeQWScvSQ:8jRP0yHfVqzlAsrnCLw9IXeQWScvSQ
TLSH
T10745BF2EF2B910F9D4AAD136454107B5FB71B82D1F209AC70170C635AF1AEE89E34F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 e02557c36c13d8d47226b90501c1826330d40089382b2cf03faec107c8958189
MD5 0d2da41a518202a7d7a85b0d12239ac3
SHA1 60c5b07026e3964981158e48e393dba31717f513
SHA512 1aa1197fe89f02e827a20a38a7db3dae47f38f000cc966680ed259528ff1fae63338735ccb8daeb72dc469c53e1634672eb3f6ab2fbbc11bbabacdc2ede7f8e7
SSDEEP 12288:9bL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwx:9bLwYReOtjfyJk5XeQWScvSw
TLSH
T166D42396D659D5B2D3035A74439959C1B362DF489BB00293FD2DB2AFA2309E9CC743B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 b82ffeb3dcfb7ba62ad46daa3898653d79fb8a98f8aebf0bec3f3e919580c013
MD5 8bbb81feb86b2d3bddd4b525a7a2c457
SHA1 150c573c0b90b9e10178b5684b6195e8447304a7
SHA512 06f0499cbf8b1efa01d3a497fa7e39d97e9558d232f08e800e63ed81f4adae3ffa72269f58c26c1a19681b8ef2383dcf7fe4d55a792740c14ccd420f97acda25
SSDEEP 12288:WObIA4LWO+vAYFTtL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwY:/ALBUTtLwYReOtjfyJk5XeQWScvSx
TLSH
T17E250155E7A440F5E927913CC9A68912E272B85C0760E7DF07AC4B6A1F337E58E3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 ecbc4d64f765d2ada255e021001fe6ec86889cde5036dca75123e924a70018eb
MD5 8b4b6db08956f977748838b7a35ac39f
SHA1 76aa831565aca6fbbb6d58b2d2ba649ff77e40e2
SHA512 9bee6678ae9e84c24e2b170949176ceaf6540cedf2be15f701aa4d49991ca12969844d53952d61d4f0d96158e81ae7d1c77ce25f94bff7df5a6162213a0101bc
SSDEEP 12288:G70VmzIYNvUyBpAL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwC:XfYNHeLwYReOtjfyJk5XeQWScvSr
TLSH
T1F005F12F92AD18E5D53BA17D8AC28649F273BC56172152CF05B0827E1F23EE8BC39751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 598867892711c0d8ee22cedd2f0b3f4ffb9fed94c068d9aff0dd59f5145ceadc
MD5 de0b3a8e4d81e0e10bc0c269338f6e06
SHA1 4e736b6d393015a6972ff706c4942507efd6960e
SHA512 01587b7965176293c9b6c4e79312d2421a9942c98ab41a79828ccfcfccf4a40d50e935cf3fe13ebd81c84b1d79bbde694d959663504112e1b260b222de33e79c
SSDEEP 24576:enXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:enXoJJYH84VVS6AmETJas+cHBjSSKHPH
TLSH
T18A65BFAEA2BC04E8D5BBD17CC5C24506F5B278651331C6CF026182BA7F27AF59E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a1ea48b24ac93bab4261b56503caaf6caafd3762047b4e16e1dae25a26adf89c
MD5 e6f4e051d5341d2fa840ee1539433aba
SHA1 40b8fa7e866910082bcd92035bd8127adffbdafc
SHA512 4cb7f7c5e7d872c7132675eb8a7f8a0a651be285e0ab7f3bd15fb264cdd78a4763a3af47d838f6df1a9b17cf93e9f9213a7461eaf0d38a4aafd42316a534a205
SSDEEP 24576:wv7Xbxd9Tuycf8M/TYlSuxwr2PCILwYReOtjfyJk5XeQWScvSW:wDLL9TuJ0M/TYW2P7Lw9IXeQWScvSW
TLSH
T107858C5EA2EC42D4E07BDABD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 590634432dffcfb506389920304821ae4702d30f0dbf58d49c6e77447c0867e5
MD5 9ee5acb0ed4f20d4aa09f7c0afa493b9
SHA1 77c54ae4f917712b825214c42f24541960f3759a
SHA512 8e3541e9b1cf80bb2f01e8b5f2c99c590db618aae4985009bf2ddc0138d2ada306eea498657cd7c321d1e370b2970e1e70a64c21854a91149e9c7d1502900fb4
SSDEEP 24576:VegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wtLwYReOtjfyJk5XeQWScvS8:VngOJOmPOHktLw9IXeQWScvS8
TLSH
T18B55CF3FA7BC15D5E03EC17D8A968906F6B1782603355ACF0560827E5F2BEE46E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 10040c353ae583dbfe9ca12b6cbab3fb68858bea49fa56161b1fa213f7de0771
MD5 0d88dbede4f8837be3286794de5adaa5
SHA1 68c6b923c8802d2c3fee2b01c5169d9e0e5f1916
SHA512 6e55d5f12d97c6ac395f7919352a46cc05d56d23507a5281838265b91c9ab7b789f18dfb8f6ac9cc6d020833a2f63b23c1248b6e1173a19590ef75fe7bb78d69
SSDEEP 24576:TLJnJiTk3R3waE4JrO7LwYReOtjfyJk5XeQWScvSS:TLJnJK8R304lyLw9IXeQWScvSS
TLSH
T19F15E13DD2A810E4D477C2B4825A1796FF31386C2B2169CB69B8D5353F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5354c2377795263de47c8bef75fce9bad8fccbbacf85f47dc7187fd5df17b1a1
MD5 7d46c3fe0321c41e6524fbf62137f59e
SHA1 1669111c8d4fca9bd5f5c7b50bd87c792830a324
SHA512 8abaa584115b23310e6657755f08ed6d1b5e2755106eb55f0f892c6448565f8a3adff1ba633d3d6b7c908291a663b555c8f383fe0ca82673fbaa51c887ae43bd
SSDEEP 49152:s9GqCzDScAZmlvTcFg8Ph6fLw9IXeQWScvSy:W+UoqxvS
TLSH
T129955C05F7EB5294E8B3CAF1C96694159B327C409B34F7EF4A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 67c75afd2dee66793e4a601acb5f967c640f08e9150d65f848bc09f906d8ade8
MD5 0cbedbd07d9c4f531b1ace408a45f740
SHA1 382ce3fe9250f650bf04769721b3b8e3057235d3
SHA512 66cc718245b48cc3b1c9942e08748a88958b244b6b7aa1a7e4fb881bf2507bc22ab246f2cb662faaccb49e1365d0b1cec49a4302649619ec2a5a33fa3354f7fa
SSDEEP 12288:nlYJeXm5nkEUuE9L7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwH:nlYJeXm5jUuE9LwYReOtjfyJk5XeQWSo
TLSH
T1E0E4125EB6AC70F1E217913885A14984E372F864536013EFA9F4C2BE9F32EE55D38790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 6e7c675e7c56b9845220beacb5caeffa8d675b2ecbe9714296f0d7d0703c5348
MD5 c5da8ed9c744c294e03c6449a17cfd22
SHA1 84b150cb3ead8a51fc8abe6506e3e433ef694ac9
SHA512 c9899f4d5cafad0560bcdcea90994951083368d58c61339ba6b13d363aa2baf9a3565722af1d7823c8d3030d0f6c49dfa67468948423af1645877a3b8d822d34
SSDEEP 12288:Ewu6kyiL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSw8:EVtyiLwYReOtjfyJk5XeQWScvS5
TLSH
T172F41245A7A4A1A1E6624638CAA341C0EB75FD149F7003DFA9A4F73F6E32BD49C30761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 020a430baed0b7e37a135a18383bb91a3993846576319ea1872865956c0ed6f2
MD5 4f18f39e61d919d32c27a89abc729cc3
SHA1 2e22276804ee9ea0c75a12c86e9315360ccf1971
SHA512 27db971219e9407042d1779dbfd1f75fb4312a6abd9372599fa8242f540aff3d3675309cb81ce5f46d9cc6f4ddf68dc859a07f7bcd94d4eaeae466cee03df522
SSDEEP 12288:MPtL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwg:8tLwYReOtjfyJk5XeQWScvSh
TLSH
T1C7D4235AD669E0B2D7035674426919C1E372FE5897B0116BBDBCF2BEE6309D4CC703A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 333f55daac064141a46d4895dba229ec7f9762b35fadeb6b89238e608dc0a207
MD5 65bf809b57def36cd69818a5acc43ce2
SHA1 05e8a3ce307984bdbe50bf7a59d1eb5e9ae93851
SHA512 827b24db9767a855e8ceb0a6d365c31be424465dcfd922b710c166dab264b31090600d9c60f5c232ff05024443ca08337c4f7fc0f7b9737bb04da7f599342f79
SSDEEP 24576:yC+TyQIu93VAumZr7jm8LwYReOtjfyJk5XeQWScvSO:y/TfIq+Y8Lw9IXeQWScvSO
TLSH
T161558C1DA7E91DCAE276C675C8A34493E633B872137186CF2444C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 7736419e40483c6dc72de00bd739aa144222e0d40f8ec65098311f2d4da4b78a
MD5 9e92645d99a879f75d4713e40a07eaef
SHA1 3098da351a02e26a5448d0b65a2920940a143a31
SHA512 4a38d5373268c0b1a4967f5b24ae4bba3442cff8c084c6172cddcc53526283c880977aa1fe1448b944d6ef5795e32f2d7d7f93402218eb20dac6ae870cf90113
SSDEEP 12288:WcyrWOstaa3kcspL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwG:PLQikZpLwYReOtjfyJk5XeQWScvSb
TLSH
T181F4F10FB3AA00A2E167C23C89854142F6B3B874572123DF56A0C77E5B775E9BD38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0a232b490e3f446a64e006cb15ebe47e782a3f9615710ff1341f753909334dc2
MD5 30e588fa1c82df448c67c8fbe3b0dba5
SHA1 cf09bb53822ebd1e21c015a02f3de675e0db5c3b
SHA512 dc0064a659e3adae304f6aee52263d14a2ee0fdbda5c169c263ab9309167a14355b5e486e5e57a544365e8ffe98259b9d193b8e2fab5f7a5b13bb81018477891
SSDEEP 49152:QpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPiLw9IXeQW:BpC7b4+80GTk3UoqxvS
TLSH
T104A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ab84fe67ccc0ab3c95fd23500e4ae96e7efea0d3b92608b3fcee608070a5b8e
MD5 7788d5e0f5743634d1719272729cf41b
SHA1 211fb17d94a6dc7d07f4d3b28cc5d840b5bd938d
SHA512 057e2c790ab2caade7d794c6d50282d65239de80c21f0d8949080278cbd8accd77cbcca53f39642112bd8b4a1f6eb8da418edd64131aeb8a3e07df1356d43ff9
SSDEEP 24576:7SAwJPE1IDAo+4Kt+l4413lUQqLwYReOtjfyJk5XeQWScvS9:7qPCIo4Kol4jQqLw9IXeQWScvS9
TLSH
T12455B02AA7F956F5E17AC774D663C501FB727822133163CF9290817E0E269E89E39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 45204a9f21558c3d57be721886c6ea3e5deaef04430d78c4114f69065b44301a
MD5 3d78d5e6a97b98efc7249ee47e7fd200
SHA1 3373149866122b2d6d0fd874b7e6201f6e179a08
SHA512 d23efe684c9ed26d8303f61b3cb29f05133448430295915bd06438701764aa2b3df1ba0489faf1eb8c6b345988e6e8ff88977eb19ea85127eddfb1790ce155a2
SSDEEP 24576:WyLXPLcT94t6LwYReOtjfyJk5XeQWScvSD:Wy7Poqt6Lw9IXeQWScvSD
TLSH
T19925E03ED66D04F1E536C27CC2A38906F6723C9D037166CB19A4917A2F27EF4A939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 8811b721fd75768bee87b31c6b53cb9afcd220a1c5bf2d513ad0efa8fb7e18e9
MD5 50f7a7890a48b53d7037839a24189d2c
SHA1 e9347adf1cfab32e3298124b0893e213c3399b60
SHA512 a0628c8b61cc0e520f96b8fb3624bd19775398cb55d60eeab60ea8c642ba522fbe14ab3ba38b09974098fd3e5bd8d4c790cd299af506b79fbe255aafa14739b7
SSDEEP 12288:b9lyvj3IkxjbBzZL7MYRJ7GD3+yS7JjagVX9yJk5JZXel2WSwBNvSwP:bWv8qjpZLwYReOtjfyJk5XeQWScvS+
TLSH
T1E9F4125E96E4A0E1E1364634D2668195D1B2BDB513B016FFB9DCE6BF4B30AD0C83DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-100-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/948-94-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/948-105-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/948-170-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/1348-103-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1348-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/1552-164-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1552-163-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1596-159-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1596-381-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/1752-148-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1752-154-0x0000000000950000-0x00000000009B0000-memory.dmp

Download

memory/1752-366-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1752-146-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/2080-53-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2080-59-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2080-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2080-63-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2088-92-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2088-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2088-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-139-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3132-141-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3132-133-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3132-343-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/3252-175-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3252-428-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3472-79-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3472-162-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/3548-16-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3548-104-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3548-27-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3548-22-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3548-23-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3584-184-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3584-183-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3584-206-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3584-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3584-222-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3584-312-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/3584-190-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3640-179-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3640-121-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3764-171-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3764-426-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3852-131-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/3852-242-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4524-429-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4524-180-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4704-450-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-453-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-457-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-458-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-459-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-461-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-465-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-466-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-467-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-468-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-469-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-470-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-462-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-464-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-463-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-460-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-456-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-455-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-452-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-454-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-449-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-451-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-439-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-440-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-441-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-442-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-431-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-432-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-433-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-434-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-435-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-436-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-437-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-438-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-446-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-445-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-444-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4704-443-0x0000020EC14B0000-0x0000020EC14C0000-memory.dmp

Download

memory/4776-1-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4776-78-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/4776-8-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4776-0-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/4776-6-0x00000000026D0000-0x0000000002736000-memory.dmp

Download

memory/4776-386-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/4872-427-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4872-182-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4872-123-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4912-71-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4912-76-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4912-64-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4912-65-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4912-145-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4936-39-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4936-40-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4948-382-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4948-166-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4956-110-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/4956-115-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4956-174-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4956-116-0x0000000000740000-0x00000000007A6000-memory.dmp

Download

memory/5024-49-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5024-43-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5024-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download