4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Size 4.3MB
Sample260708-kdzdpadt2x
SHA256 4c6471b25f923bbf2ce5054c75379af4a41b8bcc6d9aa3e37022f151695c07d8
MD5 8277c5f8ae5615b7f78123d7baedf277
SHA1 f2a29f57ebe6dea850ca5130812115a231384fff
SHA512 9b834a504e39f5aee1eccfe09b7f4def2ad0de27f2b485985d3f3a8879ac1391c453303f8284098788f01ce6e2b5b5bd4d2bb707cbe359bef45421a862d95a13
SSDEEP 49152:QJABRjHZHCHglfiwz2wkCPhiwi4XWwlgZKUxT2igHF6c9OtZkN6x4x8EVep:vNMHglfPzrkOiw5lgDx2i5ix8EVy
TLSH
T1B726D002F7828170EDC29135287E977E4E39BD28AB62D5DB73902F3548316D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3132	alg.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
700	fxssvc.exe
3728	elevation_service.exe
1744	elevation_service.exe
904	maintenanceservice.exe
4764	msdtc.exe
3576	OSE.EXE
3864	PerceptionSimulationService.exe
3996	perfhost.exe
980	locator.exe
2140	SensorDataService.exe
1060	snmptrap.exe
2152	spectrum.exe
1504	ssh-agent.exe
1824	TieringEngineService.exe
2804	AgentService.exe
960	vds.exe
2008	vssvc.exe
1804	wbengine.exe
3648	WmiApSrv.exe
2832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\76228120f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039bf87f9b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000502995fab30edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d99cc9fab30edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006747b0f9b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006747b0f9b30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b1b903fab30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ae6adf9b30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000790f3cfbb30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe
3504	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeAuditPrivilege	700	fxssvc.exe
Token: SeRestorePrivilege	1824	TieringEngineService.exe
Token: SeManageVolumePrivilege	1824	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2804	AgentService.exe
Token: SeBackupPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	2008	vssvc.exe
Token: SeAuditPrivilege	2008	vssvc.exe
Token: SeBackupPrivilege	1804	wbengine.exe
Token: SeRestorePrivilege	1804	wbengine.exe
Token: SeSecurityPrivilege	1804	wbengine.exe
Token: 33	2832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2832	SearchIndexer.exe
Token: SeDebugPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	2136	2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	3504	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 544	2832	SearchIndexer.exe	110
PID 2832 wrote to memory of 4004	2832	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8277c5f8ae5615b7f78123d7baedf277_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3132

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3556

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3576

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3996

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2140

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1060

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2152

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1960

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:960

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:544
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29b870493c130f3218626f9413b4af837a6c3d920115ff6b39527bafc8023d70
MD5 2ffe9716b82f1e546fe139c008df9d11
SHA1 740bd859766ae04be5bf0b6980afc4b1263970e4
SHA512 b92075f017732182ae2271ee25e08c221c5a920de29fd711f5d32cd34df32e4b23ed6da9179bc05589e73f3e4634ae4cea0a0a46bafe4ae037dd0804bda13adf
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn5x4x8EVep:G3q6HjBuix8EVy
TLSH
T1A6D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 028542777e48348e270170a64a7fec8787fdbcb008535400af8aee0145a067dd
MD5 7b7fe65d458b6871b2bf729dd6af88c2
SHA1 0097090ace28a1fff0968a6483a28911b75c73de
SHA512 fba83be81cfe991265d596cf27ea2941f4a5e2b8e2f1bececfa87f4634cd9995440a959a236f1265dd0b767bacf3eacd4e74031fce2f54697c16e29ca2009cd3
SSDEEP 12288:01XLsswWkxy2lRq2czAn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:SXYfDtczAnyxknw4FYnshx8OfVe247
TLSH
T13875F12877D508F9ED6B8139CDB28512E633B8514770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1285e66cf2f73412f5a91f1753246c41c5bbe9ff5ef4aeb5d4b3815d19cb40e8
MD5 a1ff6af9b6d0fbb147d71c6ce2ebeff7
SHA1 408449ba023fb9f78853a73456847e71b2833e59
SHA512 5578c1c15f97536812d910fb94aed6a0f7e25a5cac9cb8467cfa004a82cc8fca0d6acbe2ece9da000daf41c7edcc76b88624733363349600b144ab9122f94d1d
SSDEEP 24576:V0Le5ji0hmx1rMeyxknw4FYnshx8OfVe247:VPji0A7Qx4x8EVep
TLSH
T12395AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59f05f1ada5e5db508a95616903f49c7055a3a87bb5667b1a3c37e881e0c7fa5
MD5 4fba57ebb777e8d5def11e81edd41b13
SHA1 be3c8204972550b60492ddb5a2530d794c5aad57
SHA512 adb707402c404072e0f0697a03e80b65a94c5bfe68f939a334a198b2b127acd9193527edc0517d0af964b031843101a1b08085954c87027fbcbe49252b697f1d
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyuwyxknw4FYnshx8OfVe247:3/ezSC6vUzPvxHjy0x4x8EVep
TLSH
T1D3756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 42bf7df889b8da365b83d462ff360c211b01ede6e550d164ec72ebff9a113f36
MD5 4039f63657a12e65cf3f634087165a9b
SHA1 8c701e4bc2dc91f1baa393c1d55b183879d17650
SHA512 bf967164596d66712796724b55217622a252544e7129b2eceea495aca4e9858462a7bbe28bd3d045fbdecb85f0a83fccfa1fedc7b79ce534e5875f5253a371a8
SSDEEP 24576:HVbqPb88hv/l+67yxknw4FYnshx8OfVe247:HVO88hXl+Fx4x8EVep
TLSH
T1CB559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 440421d0e6c2e8d19f40772085b6bf17f1c1e1cd215f64aeb36a7ce9075595d9
MD5 9c99166112d5f121a8317ff759787be3
SHA1 45076dfe191ed1f0efbfbd1c8578311ca7aa261a
SHA512 98e21e2f6de4419a75640f95fa6ac38e4d9c74bc74da71a85ab779583c97cd712a86d48ae31e15936177dfa670068977a0225b5d630c4e5dc81cf0379e1faa55
SSDEEP 12288:sNS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sNSyxknw4FYnshx8OfVe247
TLSH
T10565237CA7DDA4E1FA5E15335A7172623616B9A0DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 04e264588fc0db7ca769cef33b2fbe077bb8e648299c561fe1ca1b50baa02ffb
MD5 87faef72bab317a05d1b5d41df954c5e
SHA1 dbe1647326c41c3214db748598e5912d8bc6298d
SHA512 d6daf36058c5c99fa3c079b4b292aede309255d046053c9db90c41732958bc4cfe7dd81d8ae9a9b8241e378f44aa8120471df775b4b9f916f5a90a3cdc4b7d23
SSDEEP 12288:QeBNUbTVO86Uz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QJIUzyxknw4FYnshx8OfVe247
TLSH
T19975CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c951cab534f44d3a268d96d2bcf1ae00ef3d4edc0603a9aaea24a7b71ad13e17
MD5 318f20e024d47adc92ba6acff59a4c02
SHA1 236e949898837967e28412faaf117177ea740694
SHA512 8d57d67b7863816c23d7402adfcc13f90d7289fcac0fb1511d5f7d585f41e22ebdfa2854159cf02473b4aae378616c7fd8f98b8c96d974efcce46f8520627a84
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:4QvGAdlCEL8c/yRNw5Cjix8EVy
TLSH
T1AD267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 a127163dd6d363a960c8417368a62a86bbd617c0fc574fd7408407dfcbe4ae80
MD5 a9a429be7ac9bef699954acb5f208bc4
SHA1 96c6dd647393a91e260f61a28d7f3baceaf2317d
SHA512 b9f82f7d8242c51d07f076d77c6ef324c6c9fc1294e0119c4f97a06edd8467df2a5830c94c96aa71adb73eb0275dfc2fa5105e528adcf53e9898117681df38a8
SSDEEP 12288:5AwSfxL/2Dc3LDLLmt0LDQewsAj1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:q6ewsAj1yxknw4FYnshx8OfVe247
TLSH
T19085E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a8240fcc13332801e66eef6be1ebe7079ab4f826112d8405e3f28b8bf023ddb
MD5 d3f965ca6632757a2b0912739e6b97c9
SHA1 f68db884fd638028dd67284a0b1646b821c71f45
SHA512 543aad6274bddc590c699a4cb5a85b63eb2db88399a7b368be3bb64fa3bb1471c817f607f984078fd97ee30f14a8ab814bdda7e16cd083c95f57af06db3a661d
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH1:wUEtQevvqc2W1cpV2EI32
TLSH
T151474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5a180d67066c68d9c243f5f2abd367bcec51afb7a23cf73f627167deef4566ee
MD5 4000bde2a52f78ecc66c2ccf39fd5c24
SHA1 e917998f907273e1c5723670394980de72ee1212
SHA512 52e5049f82159eaaa7d3ef05b15947be07a8559d2240ab6974a45021464f35fcfb74af22a75325613baec4c853175b79965bf90e987c7eda9f7ef5eac1c02649
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zgx4x8EVep:xoqtVjnm3ix8EVy
TLSH
T17FD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2eece9860e0daeb6f6f151b41c69bdf9ed3863f4d61e55f13a563c515f051cd1
MD5 19edf747b37bdfde29b644aa4ef88771
SHA1 2ce0c5e9228361006b075305bf3024ad40b5fffe
SHA512 e052cb4fb4236e849e76c35f214bccb5dc4fa35d8993afdd27cc0a1333fb5bcbbd787632a515820992bc2491252e16e5e2fafed6fc5545435366c4ad23cbacf0
SSDEEP 24576:yAhGLJIFoiwtA5l7S538yxknw4FYnshx8OfVe247:yAMyFoiq5nx4x8EVep
TLSH
T1DD35AD80E7F955D4F5B3AA7899B69171EA76BCA65E30C20F2260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7c45b2015780c7cc0e4297f1bb2c01da6f95eca5868ee210346403006f56f560
MD5 7b30d4ddddf5df2e24e774d73d334104
SHA1 89c2d162a199cd7c3572302c90794b70b360fec5
SHA512 8b79f5322126a226c13aa8e4c2fc467f9f6bf545332f3daa424efa7c525b8659e983e2d33f2bd010288d0e4de0c879406a08cc281551be301ae3fa1918079127
SSDEEP 12288:qmw5HEjsChN4BFgl0WDm+CQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:jwuVOWRyxknw4FYnshx8OfVe247
TLSH
T1B675F14977E91CF9E9A741398657C132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5bafd7593aee574066b113b4c9c8fb04e385caa5bb7388f85ef9961bbc6c9e6a
MD5 040f3b2a786805ad3a62ee0e6cbaa2a2
SHA1 cad19fb281d29e09bda94ad1c526c07100c18f23
SHA512 b81b4326be01badc9f176efcfdde9f2ccfdde337e0cd533e9d7991bb524a99005efbe59a11e9784b39b587a8758330669dac971ec0bc07a51fe0d3c35108cb6f
SSDEEP 12288:jFZ1Iyl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Zu2yxknw4FYnshx8OfVe247
TLSH
T1206512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 77a2c1a37b4ff6a77dd5af224eae10ad46beef4cc08161ab6f2da85e5aa4b37c
MD5 eb67c3aae27355638d09b55aad3e88b5
SHA1 970bb3caf313587ce73acdc72a5bf2a027d9ee98
SHA512 276c15d1a245dcb5dc40e5933b4b2b41f2ba0da2215ae792038a43c8cf765f52095758fd14a3062923fe4a378051091fdef02c936b93a2aed5dc8cd2610ecd11
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:nQRQyi36YOcPQLvw2gAf+PN3Kix8EVy
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 592cc253ffa3cea003743ec05074bef41af76b76c68869ed9b15687cf3a2db17
MD5 5ab76f0d9cad25651ed3f17e18ca7a79
SHA1 0e31a4b6d73474a2f3a0d23e9e1fa3f47b26ed9b
SHA512 868e00dc57d2acac1410929a94ccaa6aaa81211d43c31b896ca544c3386a2a01d5202535bce513ffc21b2077688c6fa0b4135de4f6a71c2009c1eababf8c9296
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:FQRQyi36YOcPQLvw2gAf+PN3Kix8EVy
TLSH
T106667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 09c77db03a18c674dbc7609bb2eaf0e80b0a5e939d099257d5799eb478aa7c1c
MD5 6321a18571f2ca9eb9033e0dbc24e53f
SHA1 a949c946ba10ceadab4e8197e26ded01d4a19c79
SHA512 6a5a5ab7ffe1058a6745af42060d0a7f6e27a6429723566fdf1c790fe2a2d06a3bf4da52dda4ef4112c14c065f0fbd7843835b242d969d0016e02bdca2e23a1a
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Gyxknw4FYnshx8Z:M68Qg55nhheWu7PNU3/Qx4x8EVep
TLSH
T126B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d97c4a936657729aea7b72d2190d628fe38178d5a3e766f144e0d13610d42b89
MD5 2868924fa1f35a979fed4f0c6ff74d95
SHA1 25a6054fd6b92604db67cb16d56c0941a62d8cdf
SHA512 0e3beaa41b1e6a88d42d84038507d7ee8d4e418bd719025f250c698b99c19f33032886705b487d7cb590a5d292cf7c2041d7adb22d1a5df6dbf8b496df1f865e
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:dy5112gYy5azzVvL69nLKnhZNix8EVy
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a3fb881328c0a56436795855adb6a3c78e875174b8c85dc44d8757ceef97a270
MD5 9ac7f688d1e09a8f072f6b7c6445bc33
SHA1 8fc5e6f84c0792211f99f9557d12c427ec794cbd
SHA512 821c8f260ddf2ba07cf226ab7a252bb6de7b74d012570cbd41e20d1fcb5cfa2174d4d200d0eef7ac113a9be2fbf22c5528f7684b191020f7330931dff3982036
SSDEEP 49152:aB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glCx4x8EVep:Iu6JmVxd2dCix8EVy
TLSH
T17BD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 98b2a8ea9d204152adaa0d1ab143e27c812036ed4b639f7386f321d6a1cec008
MD5 476ca2aa5c1b7ac13d6481c64b4c2e84
SHA1 b7e315dc22544dd9072b3f0bbf8913a71fa7dc1b
SHA512 8ca6b5778981882e8989707adf784e657c28a730d609fcdcf4d97813d835135b54b59c4ac06f652f7e4b13c222be0b1de31ff48839e684f4d51f324c701664e7
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xWx4x8EVep:bmifPbR3ix8EVy
TLSH
T1BAB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 98b23ee90b4d0398fb6b9f04cf606e136c9f8e48727bfccc5a4010a497696182
MD5 401029ee2da2a8dc3f81928fbb845c91
SHA1 c220f9cebf79449d1911f04fa9247ef3ece5de2d
SHA512 6cebc621bc40736c30a57d5966e07c22e948851a022980c86be805268817cfb2c9d8aaef03dc3841d4f89622f8c46bb9db02304104849a1d01dcb5a42a0fcd1a
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqpx4x8EVep:x5dKTi61pix8EVy
TLSH
T1D1C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a6d5975e4a7e8df7bf658dbe627ba2528c2ff1b4b94d1661b55594538cfc6afd
MD5 c4f638798bd5aed33755dddc0f417ef6
SHA1 26335ceb5c592ca2170abcf3fa76b22ca6fa2c3f
SHA512 565ab223026c19b370a8f3318619718329408304dcf19c941af4a6760a4ba029c8b652da1997e7319a21c89abf35df30762c11f843adafc197cc51c0076eee30
SSDEEP 49152:ThtSn8EApI0figngiDn0AP5wyx4x8EVep:SX2iyphLix8EVy
TLSH
T19395BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c55a9195093e8fb9b96a1d6c797bfeba1d4d6fd4264fdf2a3d5934d4dc8e671b
MD5 c9cbe0f5bec60ddb26684a0f20124ed2
SHA1 d5ca60d5d47f40b61c74929947bab6e23236cc47
SHA512 e03c76491907bfde2e35e032825df5a909b01ba6a50ca516f7a5dfee79cb8cc67744ff7616b4c91eb52d1885c5f243f41793b08ef20201df27b57dd5fab01d86
SSDEEP 12288:hq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hqyxknw4FYnshx8OfVe247
TLSH
T17865237CBBDEA5E2F50D11734A7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b007e4accca9c1cb58ecb6c328a6a27f25e06bbd3617348c079cc57e3bc65c4c
MD5 561b603624ef28808a2ce7ca8e1bbf39
SHA1 d8073e5778905bcb29926fe9e07c3ebadb08ecf9
SHA512 8b36705616685b4030e8939b6c1e801683249a39c6e0f599ccc26a22f53b89f8729205fabc5dce0da7553d54ec91bdc0306a4a5cef18a0d5a7a012775c2e99f3
SSDEEP 12288:j5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:j5yxknw4FYnshx8OfVe247
TLSH
T1CF65237CBBDE95E2E50D11734B7163626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 4aa1683589a84628e4b7a9ccfc0d8ab6b144b1017381edc1b9f80547fb0f4088
MD5 73c85971f2db5350277203fc7dce5743
SHA1 a1f4f6e517376c440fd524082a82492448b90803
SHA512 62e6e4408775745392bb325acc0ab0fcec8257dc3ac789f9564bf9b0bc645aa7521b30c017aa75b58c8a4c4db5becceaea61a5d885346dd9a96065030505c2f8
SSDEEP 12288:CL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CLyxknw4FYnshx8OfVe247
TLSH
T18A65237CBBDE95D2F54D10734B7263626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 7697cf45e1c2e4c55b6a29bbe207ea4353411cb530ef7cde75fd28673195c441
MD5 cce0a0c7a29b9c4fa904bd5bbb0f5bcc
SHA1 ffb4ad04b4bf58595bae0cf55c562771a115e1a2
SHA512 f046301d441b57b309ed48eb05ba4147e79ee105bdc6b814833157c76e5bc6d4286ef0d2db17377a61338145f3d12cdbe34922b538b03ba4e0eac96d0933de16
SSDEEP 12288:tVc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kyxknw4FYnshx8OfVe247
TLSH
T1F265237C77DE50D1E85A51738A726222B365B8E5E731C35FCB24700EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8d82a08bcd00dce3236418a8a9802e60bc279f03d5ade54ae3ec34da2b4185fd
MD5 58014cd73e31215ed19a79bca864c645
SHA1 6ece874071a8d742538d38f4ef7a787a02410b9d
SHA512 56c5f483fe9c844a38b6ef68f7621175d10ca288a109a1637117abf967ae08df268bc1143f057dd952472de135e3c72b6f3fe8fba69cfe114ab4ab9c13975833
SSDEEP 12288:4E+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4Eyxknw4FYnshx8OfVe247
TLSH
T16B65237CBBDE95D2F50D10734B7263626605B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 141e835b4bfb82b9a37fd748a2d26fac52edbc3ce937e109bbc833bbe13928a3
MD5 f2120f4567a2e941c6603f3a7e054315
SHA1 57baddd3920acfe1c43db3576f3a92e4dbf5672d
SHA512 c6bbcaf2043b72303b187914eb1b2a32db9fff4a5dd409050290dcaacc8ba0b68a0301dc39f18cc31b569b24d1e8f4b4e60316f6dc155b4f82047d5f1c1d39dc
SSDEEP 12288:St+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Styxknw4FYnshx8OfVe247
TLSH
T17365237CBBDE95E2F50D10734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 fedea6fd734d17851b174870cd495f9035e52ec5cb134872081ae5ea35a84aab
MD5 b558b973c756a2c6411fefaaaaeaf5c0
SHA1 254d9ad6c24cc4a1258baedc254d6fbb7c9d2325
SHA512 4d798d1a7444daa6a99ac184921ffcc5c57ef5ab9bf2e3103e3a08ac626bfdc52f8f0e848cb92b300aca75a939c07b0838f70b77befa5a22d904d3689bebdabd
SSDEEP 12288:ph+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:phyxknw4FYnshx8OfVe247
TLSH
T1A965237CBBDA95E2F50D10734B7163626609B5A5EAB5811BCB7DB00EF1F0C60A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 59156ed10f475c072a199216f38e82925677b6d4adb042b6ac788e859aefc7c3
MD5 50c8dc3760237dfb2bc76d190a563438
SHA1 14633303587ecb32d7b23e33814f94ddf268a969
SHA512 d42b45034d09551ce707b8bba134e5a0f55b02edcd6d135e9bbf409d1780fc70ad81dbe491bd2df8eaaec29ae20011c369783bb1926dbb1555cf1691420d826e
SSDEEP 12288:uiZwbZzzFEoS2cPvyZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RZMdzFVSOZyxknw4FYnshx8OfVe247
TLSH
T19C7502A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 4d91bcf3f100543aadd6e5d8e3abf875bae0a9459a49d15c98efe4b7f14f63bf
MD5 c24f099726cba02187fc657ad207a00a
SHA1 b6af69104f918d8ca0c9466a3de49f65b0149363
SHA512 d3758f62dc15ee1dc26c78f4c8af38e1cf8ef7ee3e537f0021063921c8320f83637c8a34a2c600d9e399ca72c198fd6584ae04582c6e2d10ff8c889cb0a383af
SSDEEP 12288:6m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6myxknw4FYnshx8OfVe247
TLSH
T17465237CB7DE95E2F50D11734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 037bb50e1dd81970c8c612dc78d349d9b3e9615618d32a9d1c3f41db63562d78
MD5 fe0d48f986ce293bfafe6e22cc86209b
SHA1 0056b1ff25b34ebb5fad21b7c0188a4b180b80ad
SHA512 2e33804f1824263642ef6ea2b8e55884f0b8b8abea888257db8c1406fcfc927ec1e0075afb2f059a3c6519f4fb6966ef83ba99ff0b66b951146d6ed11067e3a5
SSDEEP 12288:bC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:bCyxknw4FYnshx8OfVe247
TLSH
T15665237CBBDE95E2F50D10734B7163666609B6A6EA71811BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 0d0437c6ba7319680f8837398a962c5f8f77d4171cd2c69a8122b61ac4f153f6
MD5 b0e12e8312d7ff5ff318c5d8e24778b2
SHA1 80697a964a5c310f5313e71c4ad164e993050958
SHA512 a02a955ffebcb542b91a751ac89963ff7e329cbcf890141aeec2d9f049fd87008251d131f606c0c792238f2cceba5fcf84ca180cd5a8d4a54257ed50f51ca2f2
SSDEEP 12288:zyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+zylyxknw4FYnshx8OfVe247
TLSH
T18675125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 05252bb08eb0c745818af610ca5f1a8e3b70b7cdbee18d89b739bbdf51e96b1c
MD5 7c27b4d2d3870f86e323578ee70a233d
SHA1 4367bb6f53d02dc7928c53b25bd97548d4466f60
SHA512 9f89d554752dc17b8ea5a40544ead02e4eb2447092ccc52e25a33bd7a032a69483ba70e1dada91af46f5444316cb7289a0991e4df5b19938cb7368b02e535e5b
SSDEEP 12288:+m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+myxknw4FYnshx8OfVe247
TLSH
T1A06523BCB7DEA5E2F50D11734B7163626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4303af812dacbbc8f003dbd8dff0fd311d584452c7ebce5403532e2e5d6c51c2
MD5 bb73de35b24899673779081dcd5efce7
SHA1 73711a1fe49ec3b085973b626d92fec720e0e4f9
SHA512 72ef8874eb77c56ef79f9f2c6b1c3956cde771c8f9b1dc47950cc72c68744c89c8c995a747a0ba3cc47d6ed8ded7cb94263a0450724cc75192d6d49c9b24fc56
SSDEEP 12288:0m+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0myxknw4FYnshx8OfVe247
TLSH
T1ED65237CB7DEA4E2F50D10734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 287063e57838bfd9bf19dfc43feec32df02ed5c5c1779f6ed114517bce3feeb1
MD5 bbae5e0017d9e063faf684dc0db082e2
SHA1 1630a807037a4b1961aab399f1ef89b25a828389
SHA512 94fb5b62ffd9a8caa2a554d519891cf083bc0f662351084b651574285d22d3bb28a72cdf1e4e8e1ef5cc2317e13fc4cd8a8aecd265438efb8c1f53e4dac23b0e
SSDEEP 12288:KyPz5L8l+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xzylyxknw4FYnshx8OfVe247
TLSH
T16775125B73E530F5E12A4236C9621612F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 8e7d4b8a3eed8be356fc5ec1fd070b3a1b16c6e516f8da34b068b62d4d580ad6
MD5 df13863c52feaeba4c30028d43958355
SHA1 60263d3de1102a9ac90c811faef0275c39a2971d
SHA512 e47e4530e25cff3e28529b1a5a63bf2a3e9a9ed5c8703190182f887cb62e2f0e4e28c23a35b7477510feb5936121fad898df3242168240b315817008b4e39195
SSDEEP 24576:VcP4mcvIjkGOxhKP2l71nNKbrh/8KBuyxknw4FYnshx8OfVe247:6P4m4IpOO67W8Kjx4x8EVep
TLSH
T1A565BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6ac903f0332eb9645882e5924438284aea3d1c1d3e9401bc44baf5dcdceb3921
MD5 7e4c4cb9e2be52d7054b3c693bd5814c
SHA1 a086c11c18bb58f1ba8adffb9b6d6d2c5aaab9bf
SHA512 5464efc5674b979fe92a315271f7e9f3a8c0d395783bdc8082869a8dd5cba4ee946b3da6f5a5eb0df233d1ea65822ded3195e04ff783990cdfa7c22684b66adb
SSDEEP 12288:f+sf2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:F2yxknw4FYnshx8OfVe247
TLSH
T13775F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d42e0b5f507849ef5343a6ab5d49da90fc305f98b014c9a2110c6bdd7d7c1435
MD5 71774a0410c772b36281e4720be28b9e
SHA1 3771bfabe82fdfd16818b4a649da82e741359c25
SHA512 148bb9dec33a9231db2521d437270c39b511a2b6fc10aae98ba9bf74ec41be0f9db6c1b0fcdaa742566fc6140625865c9cc288ba3799420725468fecac913415
SSDEEP 12288:ZW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZWyxknw4FYnshx8OfVe247
TLSH
T1F165237CA7DDA592F56D15730A31A231361AB2B4DF70C14BDB68B11EE4B0CA0E83E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 79d5124b6d9305d9a67388796e764f8a38b2f3551a9f73b6d37c686977494d94
MD5 9a116db25c486e50e23e59753e11cf30
SHA1 88d0cfd9397d6e7525a6999549e6d4799a0bdc41
SHA512 07993733a177e575e0861643bdc7ccb39e0cc4508f316b1ee177ab5932893c631266110f45c0582e71644f4b1df1f9776edc13a3f1ea0a4b38b3bc8276e096a5
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQfx4x8EVep:ca0hNYG4Jwoix8EVy
TLSH
T18B85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE48E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 0e096a2f5c0bf07c6eb254d9b43a0be94873ed4f92830dc3823d6d5d1de74dda
MD5 0321699312b0a35f38453eadfe68bea2
SHA1 00722c7513e75d92978902d904027506ed5c24de
SHA512 c7e68e6c8f7e956593cdc585bce632f18bceaa1b9880e7333934bc5147ec1824c88bbb53075d9356f2dea5775bd96ac6e40573a6bee58246fcea47118de07773
SSDEEP 12288:ChbHjfXJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ChbHjPJyxknw4FYnshx8OfVe247
TLSH
T1E065117C27EC20D1F175A17A86A28206D331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 399d9f2c438239078b80485b2a31561db2d401677dbebf8adc42b117aa43375f
MD5 d846bc621795ba3c5a3f99351463d332
SHA1 96524be7eb42659e0e944608c91e3e7fa0a2732f
SHA512 f747a490796fab60a43408eb88829ea26f2227187983cbb1ff8fded99b55b4a6bc1694c5b683aba8526ca721aaf34ac91545959a45bc93dbe474a22ebf9f676c
SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/Ryxknw4FYnshx8OfVe247:ZIgnaTk46pBR/Ux4x8EVep
TLSH
T17C45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2ec33374fc29473d678a93bf22c2b2bcd3059e7eab11168705c819ff09988c8e
MD5 8849f463e47b2c043eb74522ee8eee08
SHA1 6704d71aee96f1ebc75232cbd15d2caed2dc5cd8
SHA512 4c0589e08fbb62b2b51dccc736efd06d76e96a56d7b83a9e0604c429ab0e79119ab10dff7a86bb60bc18ad15a9086ce2c0f93798dafeea130b3a2ce3429beb6b
SSDEEP 12288:Ay+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ayyxknw4FYnshx8OfVe247
TLSH
T1A165237C67DEA4D2E55D15730A7262263605B2A0EB7182DBCB7DB01EE1F0CE4A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d46cf8796048b2a93708abcd4a42cf5e6033448f63fc21d35fa7d43d6a06f81e
MD5 ccd3c51da006d0830475e062748b6cc6
SHA1 7c6fc15c5372810197f30b44711328d101105149
SHA512 52d91e10df55d6ad254953248b74a70b6c119286fa242e151900a72c4a882458e283ff321f512db90f15bdc784be190709ef27bcd3d4540b79d4f7daec572585
SSDEEP 12288:uOb6A4LWOsvAYFTn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XCL3UTnyxknw4FYnshx8OfVe247
TLSH
T1F9850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d2a6311a3562371f9342b3bfe3410291c6ed81dfe5a03478f7b1b00fc38beb03
MD5 272998387f19b4e6e121336c6197380e
SHA1 7dc2566e30e68862b9a5dfb0f72ca47b67423e2d
SHA512 b8dbd2c330882205a8f8fd6811b2bee98ce779f64080ec756e78e15f4218c4ab27dc56ae8e690059602b57ed93b9b7b821d97c0385a2e23ecc8d2c70a719c2e7
SSDEEP 12288:JpFtkOT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EOTyxknw4FYnshx8OfVe247
TLSH
T13F65022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a481ce464f8458f56454a599a88fa32dc995e60ab68799aa9497e236bb4b4116
MD5 81828faf57a76ba40923a61120b2daf1
SHA1 ce580491bc71c77159306b654a30ef9058f05119
SHA512 3dbd6b04f92e66f4b5924d13fee71613159f77e08021cb684104290bd69f995c5b6a6c0bd3d93d9c07bca58b953eb3887b5d186efd07fea5919873fd0a214cc2
SSDEEP 24576:d7NM9YqZqmWMUkPjZM48Mv6bEhsmyxknw4FYnshx8OfVe247:d7cBWMpPjN8DbEhsx4x8EVep
TLSH
T170659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 c6dd71f48171af3f8ea61df35db3ef51d4aaa566c9601e6b3cd3ccd8807798a7
MD5 73576f9466bb0f2a5d382be224ad24e8
SHA1 be31105cdeee4e5d1c1ba7d70153dfed3f90f8e3
SHA512 9a49bfcc5a1f1d373f3c33c2ae7508de958a11a60d890fcf16a6a9a4a47602222928c2e70b8d4838e1e61402324a04ab28b3282058321937a50b395caffde4e6
SSDEEP 24576:OW6BApg2YuyuNDYTabvcdvNYf8km14yxknw4FYnshx8OfVe247:OF2YuHNETovAvNYf8km5x4x8EVep
TLSH
T156858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e0e0321c39cc2225525ad8a664689dc9739104a7fc98193cad112bffdea04fa7
MD5 86e7164e975614b0e0db4792fb0526bd
SHA1 5d8ed3f4bfd8964300d3ce1d6823e6fb03439a95
SHA512 7acdfbe99693654afff6882e801f464ccc50ea759abfd5734c7b0851aa40dedce64c036103ecc833d75c99626cbe812af671b1e54448de70fce57c4057fd2217
SSDEEP 24576:SAFs06+Omlf3NXEbTo/yxknw4FYnshx8OfVe247:LFs060lVXu/x4x8EVep
TLSH
T1AE65AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 9518671543376954f192a0155055acb9dc7e9d725d8e46e65b299044ad5dd260
MD5 fc31653cf7ae0625006db556b0e6adf1
SHA1 305b3fb423c732e42f97a8acec79cf120db92213
SHA512 8b8d334fa67e7da0ac5799f436566b6f494219de18e51b41aa33a244b6d1cc98b65b92c5604d9b9d2ccda1556255de411eeaf00a8b7294facf64364eb856c912
SSDEEP 12288:RCJnJ5D3Vkr8zxG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oJnJ5D3Wokyxknw4FYnshx8OfVe247
TLSH
T1F685D03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 199befbcd5597c6ea3b9d4df1429cd01c72fbe2e9fac17de05525659e1860d04
MD5 43f702b51da64a35a16d72a456c60718
SHA1 cafd1248284a763cbdcb4068da84e4ed583f616e
SHA512 d0c3518d389e35cee21ad45ac505adf59ec7f404c9b7050bac0ff83291f0f07b0f940e053b204dfd7103ea5ef5200144e812c6ad7bf5ec32c6ac3040c02c1fef
SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3VuRyxknw4FYnshx8OfVe247:jg06DIKdwc+eQnSt65aVFx4x8EVep
TLSH
T154955C15B7EA5294E8B3CAB1CA62A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 bfc471ab3f519e22ec8a83f325868c285b9c9f81b628865e7ca0c35812332561
MD5 e72514acde0aada9d5a2f53a3b99e740
SHA1 ef68d162cfca0a60ece0dcbd7e7d70038d3859ed
SHA512 29ca9abc79c0d39956a9c29e3094226bbdee4df8c38999530b7a83b14249ebd45eb94d4c81df25b9fd86117a0f45108d5135b4d824fe7ef5d3d24ed736469974
SSDEEP 12288:MEP3RMQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HMQyxknw4FYnshx8OfVe247
TLSH
T14665126C77DD70E1E52A503A86A18205E372F0706B6253EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 c84fd6d0ff869e406d5dee0e6e6b1a861bba033c8b122042c1befa649dfbe9c7
MD5 d99c785d9466dca2b49ac5f9125b47e2
SHA1 e76440512053f15e0c65572aa54e9932adc985e1
SHA512 40ea9afaf1fdea3cb4caa859fe528892f387fe3fc4f80eaecef651608f41bde06599656ea3faecd771458afad04dde8587236a18f70b8901d3046e6abdfe4595
SSDEEP 12288:gjky5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gIy5yxknw4FYnshx8OfVe247
TLSH
T1C975121C63D8A0D1E57905369A7352A19A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 d5686daa787a32fd028f9321bb73d6e6c123d5d7fb5b3b70c8bc185659f052ab
MD5 65e3cf2b91cbab0adc9509ef04c0a78a
SHA1 82d4eeac8735085e1bc1ffb1151e8201b9d6d696
SHA512 d98629956b81fd29f5496c5d1d9c66c43b797d0f0a934db40b55da15a81b2e0ddbaeb32f9cd4e8ec57c7ef28e2d37511eda4cb86402a6cdc153cd96da589f14e
SSDEEP 12288:MGD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FDyxknw4FYnshx8OfVe247
TLSH
T1FE65237C63EAB4D2E9191173463163626215B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 e933e1831aac116983762edc15b2df4f5cd27d4e6737333b9d65c30fe3f3bca9
MD5 cf2912f66f74728c6c1da6a3641119e1
SHA1 aa3daa6c7695cb74142c6c1068f5622d9a3b9df0
SHA512 fee41b24deb2f5e38e7125f8a25b94e0a2f8fd052c2016c5a77fa64c0f66896c787172344c9bfaef0fe3a3b4850dbc66cf45d5cad1817a2ae9bcca999e57a3aa
SSDEEP 24576:MQ9MxZKdcz9dw3+yxknw4FYnshx8OfVe247:MVKZxx4x8EVep
TLSH
T1CF558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 6797e86216ade7bb07075eb6256a3d7002f01ca26b90d47a7000454024f4ef7d
MD5 404b60dc9ac988d5b5ca6b234903008b
SHA1 95ee704c425a790be5c4b23c1a60a88204c91fae
SHA512 477eb36d27e118452eade9362cff5c8d97f746da2d2bf471fd587436eb49252e9bab613df064617fa82b2b229e22f4881e76c0a8ae440456d5c9b2bf348ab12f
SSDEEP 12288:6yoKo2SRple9p1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6yocgAp1yxknw4FYnshx8OfVe247
TLSH
T16E75E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c44d108ca1f62d2b9837d00fef465afe3bee78d35dcc01e65f1b016434776d20
MD5 9efebcb5a9e55414f0ec71bc64f50287
SHA1 7f421aa29b0300ef0937d260d901edc5dfc10bb8
SHA512 b50d6b177d8d6f790356007e44a2d6128813aa59282ca24e7d4e346e1ee46105f998ead513cde78a395ba884a35be0e1eb39bda11dae4b0eb59a5524d779c9c5
SSDEEP 49152:9WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKAx4x8EVep:d0zuNIyix8EVy
TLSH
T130A57B3DA2EC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 483e6ff518aac16bffc885d59d05a015ae7ee57e7359b2d3604d06969d727879
MD5 d7cf48caa6736ac6a2a65c016070bb34
SHA1 6a5ad95ac1b02ac97c0af7f5bb5a0cf0b6c8f483
SHA512 d7ec90eb30cc6eb8f9c87c32fe0abf90796a4b8ec93be209fdf7728e7965004888d758540cd7fdae9848a2878cb533006e34fd51d4e67a721741226d764b4f9a
SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYtjMqbQyxknw4FYnshx8OfVe247:uTDxR+N5YzTfjM2x4x8EVep
TLSH
T14255B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 010ea6740503baab5abecebd3bd46ed724b9bfe60f44232c813b4fb4ffa5a944
MD5 67bdcf7c558665baa03b2010c58a833b
SHA1 f681502101514b6d8ff2043a636031bca21b78ee
SHA512 d29c673a6bab9cc15fcdcbf179946da96dfc403f3b6bc38d4897d48f944c6abc9e47ef93e8956cdcc2d2715fe5f3cffa2655b29e3674e2c6922b64a3df42fd96
SSDEEP 24576:vTMdOz0FFS+7mSLcyxknw4FYnshx8OfVe247:t0K+7mSL3x4x8EVep
TLSH
T1A085F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 03888c27747592fc02a80eada339aaec5048bca45eb01b63e359fed499354da5
MD5 515f839d6061306fef5d54a2111d487e
SHA1 cb11ae0a84869e470918712642925561e5ff5daa
SHA512 abbdf2e6ee372ebba3390b29a984729e051e69bbf56babe1b8c3c19dcba3222f799bdecbe5fb409845055e934c7fc825c43131defe9ab261ecb4e6eff64c21e8
SSDEEP 12288:Y4pn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1nyxknw4FYnshx8OfVe247
TLSH
T18665122C23EC30E1F46652328A325216A231B875673192FF6AE4E17E9F718E4D53DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/700-68-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/904-59-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/904-53-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/904-214-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/904-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/960-224-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/980-218-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1060-220-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1504-127-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1504-121-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/1504-222-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1744-351-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1744-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1744-61-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1744-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1804-226-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1824-223-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/2008-225-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2008-368-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2136-229-0x0000000000400000-0x0000000000852000-memory.dmp

Download

memory/2136-8-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2136-0-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2136-7-0x0000000000400000-0x0000000000852000-memory.dmp

Download

memory/2140-349-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2140-219-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2152-116-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2152-110-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2152-221-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2804-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2832-258-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2832-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2832-187-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2832-228-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2832-171-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3132-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3132-346-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3504-20-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3504-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3504-347-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3504-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3504-23-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3576-71-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3576-77-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3576-230-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3648-227-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3648-369-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3728-39-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3728-33-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3728-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3728-350-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3864-87-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3864-215-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/3864-81-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3996-217-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/3996-99-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/3996-94-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/4004-353-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-371-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-372-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-373-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-374-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-375-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-376-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-377-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-378-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-379-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-380-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-381-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-382-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-383-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-385-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-384-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-386-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-387-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-388-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-389-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-390-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-391-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-392-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-393-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-394-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-395-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-354-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-355-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-356-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-357-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-358-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-359-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-360-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-361-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-362-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-363-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-364-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-365-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-366-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-367-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4004-352-0x0000025B120C0000-0x0000025B120D0000-memory.dmp

Download

memory/4764-231-0x0000000140000000-0x0000000140185000-memory.dmp

Download