be6005de29c6beb532d5e63f907624326c0cfb53e2c29bcf77c5567d88830d4a

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.3MB
Sample260604-ph9sfaev2x
SHA256 be6005de29c6beb532d5e63f907624326c0cfb53e2c29bcf77c5567d88830d4a
MD5 e4b37268efe5d412bc0de56ae45780df
SHA1 e486c6275db33ea7a1a6aef3e8c2db73e56876fd
SHA512 bcefe49573f532060a98565f021ea9b5154ee689824891a3c46cbf3cc12182c3b1017c72a9542d3f0fe3cffeb697e672f27cde2803d48e6ae47ee80980a613f0
SSDEEP 24576:VRB/kGqZXMfUgYPLdD3sZnnQ/tbw/2Mkjy6Fr7g0oM:VXkBMsgYPLdrsZnQ/lFTjN4
TLSH
T1F355BE11379AC03AE5B226B05939ABA5453ABC717F76CDCB23C4396D98302E15E34B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
824	alg.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3416	fxssvc.exe
644	elevation_service.exe
4480	elevation_service.exe
4928	maintenanceservice.exe
4328	msdtc.exe
3684	OSE.EXE
3992	PerceptionSimulationService.exe
712	perfhost.exe
2700	locator.exe
1784	SensorDataService.exe
364	snmptrap.exe
4860	spectrum.exe
1080	ssh-agent.exe
564	TieringEngineService.exe
3884	AgentService.exe
4004	vds.exe
4384	vssvc.exe
4224	wbengine.exe
4284	WmiApSrv.exe
5084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\75b0a812d44b5a9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdd8d3ac1ff4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000778de4ac1ff4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed7d36ac1ff4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eea53dac1ff4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081f16aac1ff4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068730fad1ff4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
3828	DiagnosticsHub.StandardCollector.Service.exe
644	elevation_service.exe
644	elevation_service.exe
644	elevation_service.exe
644	elevation_service.exe
644	elevation_service.exe
644	elevation_service.exe
644	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5096	2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	3416	fxssvc.exe
Token: SeRestorePrivilege	564	TieringEngineService.exe
Token: SeManageVolumePrivilege	564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3884	AgentService.exe
Token: SeBackupPrivilege	4384	vssvc.exe
Token: SeRestorePrivilege	4384	vssvc.exe
Token: SeAuditPrivilege	4384	vssvc.exe
Token: SeBackupPrivilege	4224	wbengine.exe
Token: SeRestorePrivilege	4224	wbengine.exe
Token: SeSecurityPrivilege	4224	wbengine.exe
Token: 33	5084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeDebugPrivilege	3828	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	644	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4400	5084	SearchIndexer.exe	115
PID 5084 wrote to memory of 4260	5084	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_e4b37268efe5d412bc0de56ae45780df_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:824

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3428

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1784

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:364

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:968

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4400
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b78eda79f20229562467cfd1f4e15186a0e2fffd0a8f874ed2ee48d3589c4748
MD5 7c10705ac387ed6ed0d5e0a6fb37a847
SHA1 3f26b3cc6650e2151a5b2139d7b8b416380a54f9
SHA512 baf7b28143f730cd0992f71ae9eebe874e3dbef64aaa78354dcdc916cc005c419077eee4df7b1eafb9bf18687303fcaa0c981201cf1be487c8fc1696e0233586
SSDEEP 49152:ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnPQ/lFTjN4:M3q6HjBTLm
TLSH
T19AD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e23b915fe350f72e5c3f54c5468a6817063a34c23be53cc96dcd9b5c57a8a07c
MD5 154e2c686d4a36b9deb834272b160c10
SHA1 3a8d14d180578ff1dd5af481e12d302ffc9efde4
SHA512 f4f0403326005081ab91193902921d1b9c934f50e889987d1fde5fb7be6c52a2d4a447aec991012a6faf50fc486a881cbb8b118c61d3b2fd54c082d9dd923b8a
SSDEEP 12288:B1XLsswWkxy2lRq2czAcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:vXYfDtczAcnQ/tbw/2Mkjy6Fr7g0op
TLSH
T10C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 85422934570afbc8dfc56b2f823be47468d965cf06fa0d0878f20167929098aa
MD5 95b0f0a05266e92865ae00f112a610e1
SHA1 bd3edb077fff27794ff627d9dbc9bcc123f9bae9
SHA512 ece09b1ff0bbf607b9a59c08007678bf5ed94157ef3f4fc232b7aa9b4c1ebce31312b19b17607616b0b45eea2f12e139d1eb11e1e2a7183a10aa9c2b4b39c125
SSDEEP 24576:30Le5ji0hmxLrMnnQ/tbw/2Mkjy6Fr7g0oS:3Pji0AlCQ/lFTjN4
TLSH
T1AF859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 33c04d58ae1d0e6c188e77147d3aff3ac0a8d6d331e967aa87c6657bdacfeb18
MD5 3c9fda11afcbb7b819a0da1265312f51
SHA1 971c30b0fa8872fc13b81b50c14b48bd70e43539
SHA512 848abdf8758108547cf7800947ed3ed5b23a5482713634901c7f0586d95153d5ca588b1ea0db8991eaf9323cdd27b29a8e6926b8dc09d44e27da1f5b7aa17d09
SSDEEP 24576:ca7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0o+:7/ezSC6vUzPvxHjy+Q/lFTjN4
TLSH
T1BA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b7795bc6bb25685499b5bc78b6e32b0cd75e7bb7957f6f529307d0430e092852
MD5 aa5e23d7edfad107acf34c1dd4ced18d
SHA1 6f5ca2bfc180acdd7a7f8e64ee58e4120caf93b9
SHA512 ed29a84c650432c5faf6356e9d8a62268546f1964a16e4380bdaf83a2236dc6f320eba756acb95408e5fadfe1a805fc33b8d1ccd0d2141556c41f82fc6bfba9a
SSDEEP 24576:3VbqPb88hv/l+6QnQ/tbw/2Mkjy6Fr7g0oi:3VO88hXl+DQ/lFTjN4
TLSH
T1A7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fd29493bf8bbf3ec67aaa37debf9abbf13e5bbd4034f7ad0e3cf9b00bb03e651
MD5 a7f0b01e029c1ec039b9e57bbe842746
SHA1 40aa91b6c0137f83ad8bd4899e5eba436ff6a4ba
SHA512 e7dbff29f35b3b89fe5cb9f820fcda9cad2e8571bcb84b2eeebb0a93e7688ba3bfcf9211449b231101cf7c8f9cf281fbe0778d527275060891dab6a0462f4ee9
SSDEEP 12288:XzbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:XzLnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1415523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 c8b546609331fa1e01ded40ee178135d98d1bbb102cd0a9f9fa9fc0ddf547660
MD5 b5e60ddd5e6d4918d4b113c6cfe7e97c
SHA1 d43453e83862401031a235bb0add9637dc3b2104
SHA512 bc730b7d71ad9430894071273d684bfd1c6af5b3ed5033619b45d7f437524ab5f578eec9126f4d4d09b080d549835c405a1a5f87d0d95f3509aa97826dda61f7
SSDEEP 12288:CeBNUbTVO86UoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:CJIUonQ/tbw/2Mkjy6Fr7g0op
TLSH
T19575CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b834160a2e559ddd62dff0b477699075381074ee7b653579011af41356bb10b5
MD5 32b9f627e7cececd83346a1853cb377c
SHA1 ad782c09353abb684c13f381dbfb117bfee5d6e5
SHA512 c0283210120f24e5e877efb30c2a73ee298a2c0e8ee427e37bb47132b02a869bdea0e66b9838fc65e046c1b5395c22c35717f0e04e5b9815818e2fa5359cdadd
SSDEEP 49152:yQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:yQvGAdlCEL8c/yRNw5C+Lm
TLSH
T1EA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 33f75d9e8fdcbf263d75480926b4ff739c73fe6dcdcfdd23f2c5e62f002824b0
MD5 2419cc81567d1b3843c41bcb6537e17b
SHA1 bd36e6c84dd09bcfd907494cdd739a8dbb45a3e6
SHA512 663379e43713048c5c1497041e3160752022ef334f0e4dce511e284232f96a736f1a0b5884fc2959fcdf81210fb39ef513b28d7fe238e2054d74709c735f9854
SSDEEP 12288:fAwSfxL/2Dc39DLLmt0LDQewsAjSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgB:oQewsAjSnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 394c15de4638a9598f6645896a64bf1d0971d8aa0df6125d0d3d94f38bc997a9
MD5 0e69a9963f04624ed43d65fbe31abd99
SHA1 ed3e0afe6d1cb11064765596aaa4be628daf33a8
SHA512 9afc50e7f6b1e5b2d05e77073c6d1b7833aa545520098b848a5a51f6153e7ea37de50c57ac9ef99b03205189b5f545225329013f66590e1a174ffae19aa8f886
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:AUEtQevvqc2W1cpV2EI32
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a015a384597808d5cf46ae21d0ee4d3bfc05195f0b243dbeab97186931b092fa
MD5 e19451cf3c197b1a65cf5a7b2035ceb4
SHA1 90bea8dc4143593c223816311bb8f15dffb64aa3
SHA512 c8af64af9a9688450a195c9654c433159464a3d34fa3304137d02857b6bf856d6eb7af9c15408d6f53ee55b3a068b7271110b5caaf3a95be5a8fa04c4ba2c5b1
SSDEEP 49152:jCbRquA/m2yL5zQfFiV+XenmE3/zyQ/lFTjN4:coqtVjnm6Lm
TLSH
T1B3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c91cc5e3c512d9053b0b04539caccdafe30dfdd49e0c61d588733b84280a9196
MD5 0d9a5d51e4f046f1ee3c26852499f461
SHA1 8e02b1f1c1c6502c0f287492e2b9cc8803902292
SHA512 0544181691ccdb5159e49977b8d0012a544b4b6e2a10128286324566e6cabcd33e59270a4a57b04cb0e82bc6f86892e4c92e92b4b3a63d0dde616bbb8365652f
SSDEEP 24576:HAhGLJIFoiwtA5l7S531nQ/tbw/2Mkjy6Fr7g0o1:HAMyFoiq5lQ/lFTjN4
TLSH
T1F035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 bd2ba47b898fe6f22407e827a41146632e374bf4a39c7b4dd0a709248f85ab5b
MD5 e1e5eb58408a0e136c3f6b6bdc490897
SHA1 1ad6f1ee2c13846efeb9f0ab2af45338126319a0
SHA512 34f9bbea1ac5ec80388f6818f98b3e4e41a948f0527e768e8e5eb333a88e29ea184a3ce7f79d4598d121c236b162b1ec27cb18d5940859ed3cfc755fd91ffab9
SSDEEP 12288:lmw5HEjsChN2BFgl0WDm+CJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AwuHOWenQ/tbw/2Mkjy6Fr7g0o/
TLSH
T13565F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0b5cb2e087800e799c880cc9621da15f8b2bd6821cfef8fe9cc265c489dc2133
MD5 f3027d887ab2b7c06d6f9b19fa28e9a3
SHA1 e3cc6f76b40da90c43e30871b9e99064be75a6a6
SHA512 e1c76fd1cca0fda3fd545357bc71fbca676028ac2b0bce14fe51739734a8c3f74588ac50cdd88f189b0fc0c8d7758172b8852676f5188edec3f159a7703fd5af
SSDEEP 12288:VXZ1IyiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:lZufnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T15055126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 04d3583dc8ea1a17526450441c9958db0a4a5780c28a6478cab113faf2520210
MD5 3fccecdb02f9eeb36926d51e18cba170
SHA1 b4c8636808ac6a5922fdbc4dd06b202a9e548d35
SHA512 f5c8546cc011ec8520c27a21b22cf1b49f5ee21d6efefc8555d8cfc3ff206c03915b0462e734a3ddc60cb5c02bd385fb1c2f4c7e9dd3957eb652a1294d3ad2fe
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:gQRQyi36YOcPQLvw2gAf+PN3HLm
TLSH
T181667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 619bde5f1c1612f9a88a733da6b60baf6e0765d04438f389c75642afb06df9af
MD5 2c3ca603345b7d859540b3227b39b3ef
SHA1 1993e4ba8230c1d28fdce01514be8ec57df23ec5
SHA512 6926f71769fba7f0d3e1d92da04465516b6b9e58214353c93560e1b23205069f7384e407e2c31f87b40401820c389a634a10c0a6c3b03e9019f3f99488fa5252
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:YQRQyi36YOcPQLvw2gAf+PN3HLm
TLSH
T19D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 819b4782dc34cd9a4216280fc66733dfd1d46715534e3d237ceb7dc219901cc8
MD5 95fcbd0044447d1f85b632aef77e434e
SHA1 099befec30ab40f7ca957e8c797769845944b99c
SHA512 ba58ba17c3f29aaea41eb1011b71a980f532ae907888d359ad584c829b7642a92fef55437097c94cb61bcfd702a65d48aac1a50441472b5073a78856ab261c66
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PnQ/tbw/2Mkjy6a:d68Qg55nhheWu7PNU3/CQ/lFTjN4
TLSH
T1F2B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f08a7fe4b8759dc9877c97e622bd9a34b137c891f147cc4b8d6688bad39f4df
MD5 c1c18b8526264a8f9212df3209b3c913
SHA1 4c5dce086e4db8fdc86d200a1900e81c7076ff89
SHA512 e3432e944a9dabd4179885e6f2dcb97341f882a23f4245d3009ca4db8be363d6e5889bbd2bbcf598567cc4fb93be42e2cebfd26ffe09463c55ec0c0468f4a1bc
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:ly5112gYy5azzVvL69nLKnhZALm
TLSH
T11C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eb0464eb984fde2feb966cb4aad1097a2bb452736189cb6d6e6970f5a5457a81
MD5 7f864becd183319df3df1a68c868d635
SHA1 e0a65783e40b362a56521826084132c7662b5d22
SHA512 f0b84133f8e257c5ca315196318b8aafa74c3416d8db5552bdf355c44be134eb088d4d084b87b04b927a1291bd0b0ea3373e204ff792ec8ae8c5c05bb303b44f
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glMQ/lFTjN4:8u6JmVxd2dvLm
TLSH
T13CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9ae8df136e5eb871cc8c426d1141cbee713235e51a7d1a0689c2b7f9cf5480db
MD5 babb92c38ece5e4fdf6a640e0fa9724a
SHA1 139bac02a78c50aba2fe89b47b640538b156a476
SHA512 1619c2623ea42267c15a560428ac871a9b7035f2b82dbbf5a42f2962681bdebc0dfadf676ef68656b53123d4b2732245bb15aa3f66585bf6ee6772ae86f897b3
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xIQ/lFTjN4:lmifPbR6Lm
TLSH
T13CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 617800c9609ec68036c0c0c6cc8bb8327440b93cb9dfdc6397cbeda303cea80e
MD5 179d7b82c41f7d5d6b7b27aed56d60ba
SHA1 5cb72fdf9c67ff827ec9d42bd4911d8a39d7df7e
SHA512 78b818922627656b9d31027beec8b85bb35e41a6fb26cc21eb983b7ba75df2dd778eddc20863db0c0e0136739b1917ef5da176f8451bc8ad4a03faddcaddc0de
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqfQ/lFTjN4:G5dKTi61ULm
TLSH
T12DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 647472ba96d731c352f8766fd99a7d433a681c5f6d355e7a90a86e4e05543627
MD5 ecd33df3d94048d9b2146463ce60e8f3
SHA1 29e08a40a87d44154f2a05ee7e8a121930b05e6c
SHA512 fba4ff0c496f965965a3117f024c65d9cac6a57262ccbab9d5d0255aee51582984e18a034a3665dcd26257f691b84d16c00d455da746e5cd37554695a996b2ae
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5wcQ/lFTjN4:cX2iyphWLm
TLSH
T1BE95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 dd4730d1edac3e2ba01e53c199293fdff79ad05e26fdc9a53860968450f4a52b
MD5 df24eef44ac1b562ab6ca254c97fea41
SHA1 e135c2755abdc522cc09d11d4b1a09e9f84f1ea6
SHA512 d91fa1a329ec167d97ea17de5a5ca4bc667f2c11b1fcf16e5b785e9c8acaab6d70cbe718e3c033dc18201760abbe7f02edd94700de6dfaec6fef24fe79fbe241
SSDEEP 12288:gTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:gDnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T13A5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1bf3e247ab9e237e1af5d5b33359c37e7e18b11015f0170e3be1de574d17fe18
MD5 fb5959dcbc54be0628191d1898af49e9
SHA1 84f8a4edabc9c3c3c0d5deaf60666b0488cc174a
SHA512 1cf1df2827760e121f828cef1661541c22773966d089d230f10b137dbad5daa96a3652abcc7a6b66cf12720f87b53580ee5e530abffc9f7c505234f4238df750
SSDEEP 12288:mGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:mmnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1075523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e2a75341dd2dec3508d8d48081c952327846f8b22f396262c2c2abe8fad26bf1
MD5 2d10af8c6fd2f1f2f19e04ea8613b034
SHA1 f1c03f61a69cb15052104b7668ef3794fc2fcc50
SHA512 9c695c12865722d922b6f244e4dc5ec217c8ab3f10816e766f16b213c1b8ec3f0b671e77ed7cf8f5a63d7feaad7165976792b4ca4df6304f4c26037be47c5375
SSDEEP 12288:2gGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:2AnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1C45523697965F98BFA1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 cbf3ce6f7520d2f188e8d92bd1bb7ddb4df7aedb47041f89141f664d36b88413
MD5 eea5d36aa624bc4abc149bdce06c792b
SHA1 1e50a953e23074e7dcef60401ae1598ff5b9e793
SHA512 b15392842134d5c2f28cc908358c27b39c7843287f2b214fe63d406d29f8f41af7134294a878bc3abc81303ca7c82471459cb64a5576324a94b66ff3526a4f13
SSDEEP 12288:NV1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:dnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1965523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a565ee88e8265f5308b7cbf811ee8449f1c5232fb27d2fa256ff70ae6b5fc864
MD5 075410f1fb759171b1ea4ec85e050010
SHA1 5b921b5ee807a99e060cace8a76fb841ddbca42b
SHA512 a1b589e3295f722ff571c5e615b671fba9fb6372266be25428d52f51de811b6b757c86a75bd03479d6d3c801648b2908fa5a13a6c0d7a5741f01de80c96e15d8
SSDEEP 12288:N9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:NdnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1EF5523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 30f040f78ed46a59d212fe638bb636f23a194c2f039765fabff653a7c03916b5
MD5 faa6f69396e1de4eea248ba696d2544c
SHA1 20ce30b5b1f94a24fa2ea23079a0b79325404889
SHA512 c0aca413cca12faaa9620a8cce948fb456a4a6e9c11c6f1245187fa8f71fba595528e3fb669b6ce24b511a7b17a8503a91a6b6e406584b03944b79d6e7cb2cc8
SSDEEP 12288:bqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:bqnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1C65523697965F98BFB1706F18C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c2e6b90557d829ff64cac34a9c26f3d9977feb5ec972ea8fd4ed235d0defdb30
MD5 332aebaf5ab58b822b394769190ee5f9
SHA1 c64c2c497fe02121ffe620924a21fdf0d76dd0c3
SHA512 504aec6f2719bb64ddac80eeb0a0ae873ac90f5b02b7fa13b50d06d9472a1c08aa9cb45ca7c2c808e7487ac5c6fc584536cf2267e25033307959acf29354f551
SSDEEP 12288:QOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:QOnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T16C5523797965F98BFB2702F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5287c6d222e5f7b075a8c7002c72404adef922beb00326d78a6b5ed6f2bc692f
MD5 a67da170aec27c36f1bb67dcd016cad6
SHA1 03a3e172129b829d1faa62b1600b6c2976be96bc
SHA512 62b0ec27af490473409b1c6053bd8b84887330ffc818150e510dc3d5e6564d7722760b9c95cbc4f0a48be130e31fd26821a87e952c83ae10cdce8fc804fea5d7
SSDEEP 12288:eiZwbDzzFEoS2cPvymGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:BZM3zFVSOGnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1457501A5B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ca508d0b245c6d9e3a98074616f06a3bce9a6baccab586152503df53ab6ecc40
MD5 ad0139699da0fd33f2e07cc72e59c348
SHA1 3449d081f1774d252a2453f58765e3938e85600f
SHA512 38b22dec5d1dad56254ccb78b316b4ca38fccb24f285e9fffa5056e0a88637363f3f1f2fb4ff0ea76acbb90c3eb79eb5361238c56b886d1ad5e3fab4fbd06052
SSDEEP 12288:2PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:2vnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1175523697965F88BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4192805f68bfe22ce20701212e94f04116f5f29e892eb11abdd11adcf32cfa53
MD5 cfeb544b54aee29ea9c0ecaea8c3d0e7
SHA1 cc26ce5a99f88dbfb0d9f5b4ca3d9a42ceb56ef1
SHA512 37ce4922814dfadb6cf15624cfb12ba0818cd54f89eb37a396dc2d3aa0e89d01cc7862c4fcd7072c16522337be935922b0e1eacee15f916d855cd864ca4a5426
SSDEEP 12288:zrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:zbnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1695523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0ca4e84fca07534dc5ae40748a6bb51a1c2be9d3c2a89243ea4c788f1de348b6
MD5 425b770d4bfd87acea76338ed976d8e2
SHA1 0b9f63cfb13d99f8ce540a2b4c16a04e74348aa0
SHA512 77f222c00cc558c747b82c525bc8621ddbf7739724af430bb7f95c7f9d90c7e2345a18248f4575969d7b67beb2c74f132c171a5f86d293a231b59a4c09618403
SSDEEP 12288:PyPz5L8iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:izyinQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FE65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5fb045b075023a4955e017af8d3c94fe7210f74fd45b6ec6e6846472f1dffe86
MD5 313a6b4dc0aa5a3bf80f472fa904efde
SHA1 4f78077fd16bd249a2842fad821d48f09379c2fc
SHA512 f129d311abcb8b06c93712738bfecdd06293263e66a24da3bf0475b0ed1ec8766e0c3d9e3e94de31bad9c92014b54f6991bf80a7500e484b341b9cfb450a5d3f
SSDEEP 12288:lPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:lvnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1A65523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e132ec5a0cf1cd911ad424eefc1aba42ba1f78e08c7cd59c936f15917a10ba46
MD5 cdf83818f48fcc9c94f62cb3518ff163
SHA1 29e5a060786629122da90e5159a6626b2aa6448c
SHA512 d99ab7510233b534a10c0deb9fdf48df21e9a50c1c16a9137a11a6ad43cc7caffe4c62cbe0b65ed0cf35b19a2669a5a428cb8865c8a82822288f6b74668208e1
SSDEEP 12288:CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:CvnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1795523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2760ca8d84b875aec04f6c2e02e7efb561170b1dd2b7942acaf4d9c0a04e56bf
MD5 944dced1415f69fb806bf749373bc6b0
SHA1 94d40d18aba437e454b3302725e7e37fb5bcdf30
SHA512 24f6adf9635f9a507709b7af9002368282beff8a203cd76ba2d4e13e08d907bd36af31c667bfa3ab99af68dfa923d7045e8ee8608b5422ca0a98f3522a83e06c
SSDEEP 12288:iyPz5L8iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:/zyinQ/tbw/2Mkjy6Fr7g0on
TLSH
T12B65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 5eac2d0303c39cad8081ef5fe287a0266a5c524c9bf8f470e5d3d09989ea89de
MD5 e2e213f16771c762ca298b7efe5cbc49
SHA1 012448f702807b3ce97764e1a342eb1bd24b402e
SHA512 8c57966a4a5688c0aef8223ffb583dc6c80277d94a1b57ba1195c7b755541c098ba237b3067152ac4286609b839cba2a5b1599b38b9cb5d3b740cd7548072e70
SSDEEP 24576:4cP4mcvIjkGOxhKP2l71nNKbrh/8KBXnQ/tbw/2Mkjy6Fr7g0o6:DP4m4IpOO67W8KJQ/lFTjN4
TLSH
T10B65AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9e34ab7504fe171fc6f9d8a7e064f03ed0e3e58217d4f5b66b2ab40f9f2b68c1
MD5 a9a6d183d3b85e761c043551b1863430
SHA1 7b67a606f9dd04c98e7158e2608ead740579c1fb
SHA512 bff6ad2eab58fe609c25982d32751148e02b22d7cc853dc644ca1189defdc0f369810131022a7b44d5df7253ab5fe88d2c636cf6e2e0aab1be7b6f864b67f4b3
SSDEEP 12288:2ssf/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:QfnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1FE65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d699fa4fde710ebd241220169267d7047c1646e829c8055900b105d80faf46d2
MD5 38d9b00d4a94d45cb4b1c799869cece7
SHA1 505f831d63203f9ee844f6adc8c88b03c1c93ab6
SHA512 533d205537f0146ba47959864ef9ddeb2e1ded9bfd1881d845edeb3fc75b86d9ab661167c1b34b13124368e20d8543417c066a82561344768583e5c3e439cafd
SSDEEP 12288:DfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:D/nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1AF5523296768F94BFA3B16B05882C151673F0EC5BF91D38FBB08222D957C3D01EAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b1fe492dc3b4f24999025a6e9784e3f2f1c48e9b73cb7e3d29fe941a44ed2667
MD5 6fce6c87cb8bcfa3563f5ebd23f7fee6
SHA1 96a9451a8bb3eb979b50edd417b7cf1b774a5331
SHA512 4812d6306473f2cab15e1180408d5057e4f941cbedefc9995686bd021738f734d4b7b21737f62928abd79b85b96e0732548e225501e09734b65bcf30c3a90397
SSDEEP 49152:aa0h2GEkuAe73q3pp46zwwQdQ/lFTjN4:aa0hNYG4JwVLm
TLSH
T172859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 98ca513be22e5556d9b88985bd2ed827aec835034e4b8c579e9a8053ca36592d
MD5 8a8af5c717174de3121c477ac7044222
SHA1 d4c007500dc69e03dc6121a9316f8261121ef8f0
SHA512 75f469666092a67cdfa27aab2d1a9c2b18e69df6cbfa40a222659a7f16ea063a4a0ab64c010dba6bcf82223530f0eb795879ffffcb658a984eca910c34cf4770
SSDEEP 12288:EhbHjfX2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:EhbHjPWnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T14A55027D26AC30DAF63692BD88928546D7327C552B11A3DF2384823D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ab01179952aa29faa0cc47ef48f71cb7c04614d9ec1807bb27d93d5d27d5a4a7
MD5 35100050c0d6a145f9950464e229b557
SHA1 8e5a088097d2439c34f62dabbefce68bd1ab2029
SHA512 1c1c03eeb2c251cac541a462f10a3158871eddcbf4dc6b7e2bfc20ec4c8f3a1d3b44f7c80aa21379eb400c27841187ff07e37ff2009d494312a643d9caef3f5b
SSDEEP 24576:d3YgnJcRTk4yti+R5dBR/enQ/tbw/2Mkjy6Fr7g0o4:dIgnaTk46pBR/eQ/lFTjN4
TLSH
T1C145BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4ef2b9f967633e9980cd77ec7e8eaf8c883ae79154ef2d5afea228a9b24eb7e0
MD5 84c9439e42195a3cc6d40a3abbccfd0f
SHA1 ab73711abecbb8643201b4a8fa45fdd8add16830
SHA512 c4c2401336d283bf9ff14ba92c9f71dcd61a6d7e71f65855115473921002ca7a0a2f34b7cff8013b8c57d44780e400f43f16f52d85092a3669f61b8272eba127
SSDEEP 12288:17GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:1rnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1B45523686614F98BFA2706F54C838546673B0EC17FA1A3CF7B48212D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 83b391eebbbef849a34921ecdc73c275f9fa9d491989ee4fd9ea92469e49a863
MD5 ce11ba932e48b412b17b56b225c25fc9
SHA1 1b4197d7013e36b29361d0fd890acfe0689c7e53
SHA512 b3a886dce2ccc4fe18184821c1f1ac44272741177b3a65e9b43f93b0023938755554f7829f2284e39fe4badc713d0aaac574ce1a57d30e12db676d7b99a205c3
SSDEEP 12288:bOb4A4LWOsvAYFTcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:kwL3UTcnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T12375F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 b640a32691400f96b176e0e59e176a68a407560f0449d7bc43e0cb4cdf4bb3e7
MD5 6df2c63e1d0b90ff14fecf2aed5757b4
SHA1 bb66d2b26578bfd94a7de8a47e4e0ff4f3c15bb4
SHA512 5ac71cddbe393af1e98dadfacc3078898b506f28a3bd34c2b9cfc90c4042b7f7c55b5d8d6a41502051d0df45617f941c6c7d1b0589c5d6d431e55efa4abee0cf
SSDEEP 12288:npFtCOIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:UOInQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T16155022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F7BBF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b0ee22bc96b946d865aecf52222b73434996406218049c0756ac093688a4332e
MD5 8d1b35fec419c1131c6a32a1d685d963
SHA1 7d3e781efee647ffec78ede59b9ba9493fe398fd
SHA512 6ed30184a9cfce8df7c8c7f64d39e2dc0ebd127aa0889cee08887efd4e3b586292e11d582586589f2117a1d09822b5135352bc03e49533e0f3d300839153e0f6
SSDEEP 24576:O7NM9YqZqmWMUkPjZM48Mv6bEhsvnQ/tbw/2Mkjy6Fr7g0oj:O7cBWMpPjN8DbEh2Q/lFTjN4
TLSH
T111659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 78a8275f8d8022617bd1c89e2560f6befea8754c0ff76c5b22f6c52f7abb5bbf
MD5 49d7a26bb339603910f4745998848305
SHA1 69b5bccca4b1af0c7c0242229df301a86b902e02
SHA512 92bf8230a98c86bdfca7219e32e5024d6a813dfe5886e0b7d21f66576dbd3fca1580baf7bc37ac8136d782efb2f5033e7151f85f82ba592cecab17cc5d59c540
SSDEEP 24576:pW6BApg2YuyuNDYTabvcdvNYf8km1hnQ/tbw/2Mkjy6Fr7g0ok:pF2YuHNETovAvNYf8kmPQ/lFTjN4
TLSH
T191857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ebd3caec90073326c041d7ba1ddd9d3493722a774a5e490bb518653793318849
MD5 99d8e4c984e80d8f4abba6b91462bc18
SHA1 179510b29e6732016556f0d6cb77c754bb8ad8c0
SHA512 4905bb921f0cef039c8c1a1fbf234db62002c86e046139303f448f5a9e0c169948e2e024844ac659f40668ba3df03cce24417aaec8bf4e57e8b0e5f4e623fbea
SSDEEP 24576:PAFs06+Omlf3NXEbTo0nQ/tbw/2Mkjy6Fr7g0oD:YFs060lVXu9Q/lFTjN4
TLSH
T13E65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 613622cc2602cf3e66b024dbaba3cc2c09f8634b72a746039f00a86373a19d8e
MD5 b323a81e6e17df174261f5ac3e2750b7
SHA1 f20c1b39e8a7b35a545d30602e90ba0b15c88ab5
SHA512 87bacde009b4fbd77ae2bd1a034f1fdb54218b83037e4aca9e845258616fc49798493aea804e840bc4f2bc84569a01084abb8d4afbc03bc2b9a076754a387140
SSDEEP 12288:+CJnJ5D3VkrqzxvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:PJnJ5D3Wa9nQ/tbw/2Mkjy6Fr7g0o5
TLSH
T16075D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a92007128f7224d536ab197ae71e75a62702ed57f4a3aacffa57115316ea8dd4
MD5 1efa58a1892c30efb1a73a0516b55362
SHA1 b5ae688f28c01ff267c6d0338518db0b92c7b71e
SHA512 1228fde7e6b0de99e6f7c32c04710f74e1d52013d1906a995955373d6db855113883fa95c0379d04bddc885df196ec6feef4c19460c80958f0d372ac93d5cb0c
SSDEEP 24576:3EPghm6/7IIXdwcXrif7qQncjlP65i3VuenQ/tbw/2Mkjy6Fr7g0ot:wg06DIKdwc+eQnSt65aVDQ/lFTjN4
TLSH
T1E6955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 8116a05feeea3153bee44faca14d3bc9294f3bca58176106a2401054a80e9701
MD5 7b4afe77665b7ad8d60926c70b9f6d29
SHA1 8378332e4382969e301c8d1aec5e335f3b89f268
SHA512 874f54303fa7180c91cf02cccd55151e2ffa81745a364bbf3eaef71073c5af2a3f002d434f2466b3ef12d0da74a2344484a4be9aba4127e0af5fa6163a695555
SSDEEP 12288:zEP3RSJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:4SZnQ/tbw/2Mkjy6Fr7g0on
TLSH
T18455126D37ACB0DAE52A517D88918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6fc1537825b424506f5357ef9d1d8436f88ef818362c3c328aca86e6dd979ed3
MD5 5fe4c2729653f66d35db731690af93d9
SHA1 8d492bb323e7662d5511442e1d7212ccd7e51cd0
SHA512 5bbea055f5b3d1ed4f9ad30e3f77de1c1dd853ff91256c271252120433f237fd3ee898c22ef248a3bd4860cf7876e97f63f256c8208d6e908de58fd42bce14da
SSDEEP 12288:rjkyGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:rIymnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1976512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c8706c32312494c62983e6393c9b0b63f1b5140a329fa3595ec4a0a2db6944e9
MD5 371d712e3f3ffdbda74ce7f514de5fbe
SHA1 e8e2b9a827331681be8b7186aad8afab4a2b3d24
SHA512 52679446659db06b269e8ed2e1688a80e3eb7052a835a4bd2f724a801b9d20dd3c9e235b11685213fca3b11b4f6cad8d5b194ec00d7cc1278393245f5567934d
SSDEEP 12288:g0YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:bYnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T17A55236C2665F88BFE2706F448928542973B09D17F9163EF36C86239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d1ac2e18f8733c169d87fdc7a2ad201867c5bd531580eb976eb3eab0f9c1ff7d
MD5 c12c2820b52f9e116aa7af0a1bb33eb2
SHA1 ac7a10e5ee4a67694087fd704bd40ffe5a038801
SHA512 79657443908e8fee28ea459406623dedf6f7d8bb355818bd9c413a764cf6157d145a95184f889de644624a4a503913e88c67c4baae69b31816af5f26490be1c8
SSDEEP 24576:0Q9MxZKdcz9dw3HnQ/tbw/2Mkjy6Fr7g0oe:0VKZHQ/lFTjN4
TLSH
T132558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 79c8567dadff797ccaf168a531887ab81dbf409d73f07dde4c00fdd7c4b4cce8
MD5 8733a5522f0376f19c0ba3d1a0eb7fa1
SHA1 4bec2d61eea1cfa6268d1c555a728d10216d87c0
SHA512 2dc38938a9e5d837d707c55750b71807d5579f1b50ddf4d1ac6d321505209cc2578d7debf437ea2cc2a7ecd269590ad5847dfccc2ac5efa341c288ca54417f69
SSDEEP 12288:lyoKo20Rple9pSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:lyocSApSnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1CA65E01FBB6990A2E136813C88818745E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c4771d60ad4e40156d43574819ecfe847e8a2860760bb65b42de4bf517236f0b
MD5 7ca956ceb935aa0ad7b0c7ba2ab98a12
SHA1 8267fb4e20d26dbb3d3ea8a4a315da2817af38b1
SHA512 005ff2fdcfa5839b4d9467dc9edc30ce3a7018b1238f21d7ff99ea77a5c24cbbd0541e68422523ffdc7c4ef66b46d29f282e8fcec3abede4c64e9d4031debd79
SSDEEP 49152:mWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKSQ/lFTjN4:w0zuNI/Lm
TLSH
T188A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e406579bcbec229bf37338d78a33677819bfa5a6bc8c348134822e356f07ecda
MD5 6ca440acf7ead76d1806f2922858f11b
SHA1 2dac06cc8e3a99c63f6cf83b43996ab44c8150cb
SHA512 d85964fda6a197c5feae9e4687e974c7ecf6498dc0e4152127c033b05b3193036a5e86bbfed57a813c40fe5717cfe92acb097ffcb53ee20754534dd2a50ce371
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYtjMqbZnQ/tbw/2Mkjy6Fr7g0os:STDxR+N5YzTfjMoQ/lFTjN4
TLSH
T16155B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 4e5d03ba64263c762b4738b9360f5a511264767df208e7b97e6e2d54f535db99
MD5 52f2dc365df397f308eae7aaa344e919
SHA1 842a4145221ff4ea104933497bec4ee27aec241b
SHA512 34fa6926aaf45c48bb2a4c15869a2555309f99ddcd016beeb4730fa04f54ad81e2587d14e20f7cb124979fce14addbadf7c739d35e12fdd8b274d72834d5b0c9
SSDEEP 24576:jTMdOz0FFS+1mSLVnQ/tbw/2Mkjy6Fr7g0o5:B0K+1mSLVQ/lFTjN4
TLSH
T18475E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 c59a0d91397a95169f18df855e387a4107ee00fdbaaea0169ec83d95621cb51f
MD5 c14eb2996d423d7057328a688cf80bf8
SHA1 a21fc126c34c061c7c5b22f5146f47969e4541f6
SHA512 46f63d8ff34558a0108b4fb1e3d1d31c60232a3c83f6484bd159d3ee205a196374f0515f40b5f652853324d07c55679b8efde86da12130ff25bb52b1dc731778
SSDEEP 12288:Q4TcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:HcnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1D155122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-290-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/564-293-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/644-396-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/644-37-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/644-31-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/644-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/712-287-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/712-98-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/712-93-0x0000000000620000-0x0000000000686000-memory.dmp

Download

memory/824-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/824-333-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1080-292-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1080-123-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1080-129-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1784-289-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1784-352-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2700-288-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/3416-40-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3416-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3684-300-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/3684-79-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3684-73-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3828-348-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3828-17-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3828-16-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/3828-23-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3884-136-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3992-286-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3992-89-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/3992-83-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4004-294-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4224-296-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4260-435-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-429-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-401-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-404-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-405-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-406-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-407-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-408-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-417-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-418-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-419-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-421-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-420-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-423-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-424-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-425-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-426-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-427-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-428-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-431-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-436-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-437-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-438-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-439-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-440-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-434-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-433-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-432-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-403-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-402-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-412-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-416-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-415-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-414-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-413-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-411-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-410-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-409-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-422-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4260-430-0x0000016F7EA40000-0x0000016F7EA50000-memory.dmp

Download

memory/4284-297-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4284-399-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4328-398-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4328-69-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4384-295-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4480-397-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4480-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4480-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4480-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4860-118-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4860-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4860-112-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-65-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4928-54-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/4928-67-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4928-60-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4928-61-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/5084-166-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5084-184-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5084-247-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5084-349-0x000000000CDF0000-0x000000000CDF8000-memory.dmp

Download

memory/5084-400-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5084-298-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5096-361-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5096-299-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5096-0-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5096-1-0x0000000000B40000-0x0000000000BA6000-memory.dmp

Download

memory/5096-8-0x0000000000B40000-0x0000000000BA6000-memory.dmp

Download