58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Size 5.3MB
Sample260711-graqpsey7z
SHA256 58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296
MD5 57e8871e3535b84423314d7efce75a48
SHA1 858c4f3615513ba59eeac4ca851b2d9ec8ebc9bd
SHA512 f6086f87e138f88d022e2982975dfbbb13460a36c1c58355ff553d538d927836bfbfc81358b15883892e6a86776f7e6a8731fa0542e53267af94978d1be3e677
SSDEEP 98304:aajqHTgFRDKAVYXKbO1EFsNOnPBpJVwjdIG3rUUWVtZE8grExHC:aCq8PCXpTOnsdIG3TugQH
TLSH
T19D46D022BED14173E5A303319AADF77D647DE660072580D7A3D04A5A2D302E37B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe

Executes dropped EXE 23 IoCs

pid	Process
3760	alg.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
512	fxssvc.exe
3132	elevation_service.exe
5036	EFF.tmp.exe
4804	maintenanceservice.exe
3188	OSE.EXE
3312	elevation_service.exe
760	msdtc.exe
4880	PerceptionSimulationService.exe
1832	perfhost.exe
332	locator.exe
2076	SensorDataService.exe
1248	snmptrap.exe
3704	spectrum.exe
5092	ssh-agent.exe
2992	TieringEngineService.exe
4152	AgentService.exe
2424	vds.exe
4648	vssvc.exe
1068	wbengine.exe
5044	WmiApSrv.exe
608	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
5036	EFF.tmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	EFF.tmp.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\52047695905883c7.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EFF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edb4bb01fb10dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7f27801fb10dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000143fa601fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085a2a801fb10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fec1302fb10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa8db401fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032b69c01fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039b4da01fb10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edb4bb01fb10dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4020	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
4020	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
5036	EFF.tmp.exe
5036	EFF.tmp.exe
5036	EFF.tmp.exe
5036	EFF.tmp.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3844	DiagnosticsHub.StandardCollector.Service.exe
3132	elevation_service.exe
3132	elevation_service.exe
3132	elevation_service.exe
3132	elevation_service.exe
3132	elevation_service.exe
3132	elevation_service.exe
3132	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4020	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Token: SeAuditPrivilege	512	fxssvc.exe
Token: SeBackupPrivilege	5036	EFF.tmp.exe
Token: SeRestorePrivilege	5036	EFF.tmp.exe
Token: SeDebugPrivilege	3844	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3132	elevation_service.exe
Token: SeRestorePrivilege	2992	TieringEngineService.exe
Token: SeManageVolumePrivilege	2992	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4152	AgentService.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe
Token: SeBackupPrivilege	1068	wbengine.exe
Token: SeRestorePrivilege	1068	wbengine.exe
Token: SeSecurityPrivilege	1068	wbengine.exe
Token: 33	608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	608	SearchIndexer.exe
Token: SeDebugPrivilege	3132	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	EFF.tmp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 5036	4020	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe	91
PID 608 wrote to memory of 3712	608	SearchIndexer.exe	122
PID 608 wrote to memory of 4076	608	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\EFF.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\EFF.tmp.exe" -u -product_regkey MobileGamePC
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3760

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3000

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4804

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2076

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1248

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3712
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 57cad03bbddfb34ff6b49e86bf75cd2ffc2c9a76ebc7ded2cf9786d22bbd5055
MD5 19bf4f7a224bdaec37a61d79359d841f
SHA1 4b0239b3ebc310f7fd1a41d407bbb5f051f3a5ea
SHA512 9d142ec83432f2e986989f38ab24c3d996321277a107a8ff8fbe52058d40bff390a8a0c635ae8400f2a76ddae04e2d998106ad72b5ac21c77a0d610f26213dc3
SSDEEP 49152:bb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnoxHfJvYrPs9HHC:p3q6sjBJgrExHC
TLSH
T17ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 87717e5c5151b62898c67181205044e5841b5a4cb88793f7593151c03896c91a
MD5 e5d38c3b4d5e807dd1848be041566c53
SHA1 6bf1716e7e35257b7e14bfd9dc9c6ddfa55238ad
SHA512 4accb8ddc4b3548be38213091bc12e95eab97a85f8b79b81307645289b6888e8c96c3302451f76da3822f13e120e86e2f483f5c3d64d46af6d719574c9957738
SSDEEP 24576:7XYfDtczAxxHfJaMJWTTXPPC1X9qSH9Y6VyP:etcGxHfJvYrPs9HHC
TLSH
T16675022877E509F9ED27827DCCA28111EA337C5547A0E78B03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c88d661f1654c8885ae8bc0680c2b83dbbaf650ee0362d5135efacfe0dd00b77
MD5 9975047e050a246b3c76f936f57a0d8a
SHA1 4f053f958065f6c9279624d1ed9e809cacfe06ce
SHA512 4466103f126091ecf33c56b38e919cddba13a4772934716a349c9c7ad5ee91856691a3037c71fff519ee50e7fcb8d85882cecca70d9dde29d6995b10ca5824e9
SSDEEP 24576:h0Le5ji0hmxxrMQxHfJaMJWTTXPPC1X9qSH9Y6VyP:hPji0AjDxHfJvYrPs9HHC
TLSH
T140859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f630b254b770bc2e007828a220f2853330a4ba27dc3c1f6ab0ab256a544ec8d
MD5 c7909a16c81e83a4892c08ab3941df3e
SHA1 e5ece4ade3e9cfd905f03cd489d055897fbbc6d0
SHA512 adcaafed7a076dd7edb0d035ec4a240ee017cbf40b32fc4d1a0d4e2ec1f7463393c68a3581d8d90d8548a87911364fa5e016d1e88d1cf871539d575256193ffc
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyu2xHfJaMJWTTXPPC1X9qSH9Y6VyP:E/ezSC6vUzPveHjyXxHfJvYrPs9HHC
TLSH
T1C1755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a3f6d3c2a7d209fbb67197a9c89882d7ee8f59a2a1b8746445a0514c3e281b7c
MD5 a774b5262e54b757a1ca438f72a2c8a9
SHA1 6e9b46b55a4ad78a71f4e1288c34be31ca82b28f
SHA512 d8f88e4a32d47336a2418c3a6745258e157e7ac6e0c3c3615951f3d7dc5655aef97373869c5d72850fa22d99f2125011688e4c19b3012886fdf6c2cdcb384825
SSDEEP 24576:mVbqPb88hv/l+Y9xHfJaMJWTTXPPC1X9qSH9Y6VyP:mVO88hXl+exHfJvYrPs9HHC
TLSH
T192559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e5ec7f8079b978aac783300d507ca1e8b0a83a38b243651722f731430811ded4
MD5 87d60b7e2cf4e342a0db4dc10104d80e
SHA1 ef3600009ff5c51ef44fb31057e624557d7fb7c4
SHA512 410be98992dc73dd72d94c3f7bc460b6491e0c4a23c6d2465f49924f61daa7a08a06ed3e809a1e3dbd92257a51112804806c0a958b1d20b1823f0365600556ab
SSDEEP 12288:7L8xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:7L8xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15D552352DEEE9375EF21037615D762580852BD6DABD7990A1003BCCF263ABE4D00E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d860e5fb34d625b19d96ca212e48c1cdafe321492d136a7a02df08f2f030421b
MD5 10e917130a8d2ae87798e4064a7a0146
SHA1 9a56fe1afb0b6b83ae866b3f55a549e0f092d6b3
SHA512 0d6cd5e04d223ec8bd86242c757751ab103e23c43b7f92c3fdcfe2a0987a98a786b71779af9ae1a36ae2c87f22501f8473cd434d94e60b8cb725c8bb94b3a598
SSDEEP 12288:KeBNUbTVO86U1xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:KJIU1xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FA75C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 61d292b8f81e71f67321e7ec42812d2b51a4d56b2ca1d3427bf5a419038592b4
MD5 6d63a463782d0ac805b851b8a7bca908
SHA1 58359154da2a4363e69a7da691d2b5ac48426290
SHA512 be408a7a6449912795bfc547392c229f3378e9a7291f44da8127891316fa947eec7981fef21afe93f6275257beeaae4cd5cf5864b99767e3e126dd444506e72e
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THa:EQvGAdlCEL8c/DRNw5CmgrExHC
TLSH
T12D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1125539f57f92c8dbf601a3c98b5217b08db91e9cb8b5612fd96807b7de45f29
MD5 caef3433b5ec5df3a0d92981d2c033d5
SHA1 98bb68e0d1587a80024a3249c0749b08367f41c6
SHA512 9577792c5f7f24ae859b451ab6486dd8cb0e25c37a0c02f15475324af29a5c0895f60eb4cc89af38f9992ba25b3181c43ec153e2f9760bdd54468ec622ece066
SSDEEP 24576:O0ewsAjzxHfJaMJWTTXPPC1X9qSH9Y6VyP:vljzxHfJvYrPs9HHC
TLSH
T1C875E031FE75E036C77B0DB61B26C716146DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1fe5ac16ffada19137db57750f4ae169783161de342baf7b0710ceb33be00fb0
MD5 e7209a830913b4124d4cd79afc6a9a9f
SHA1 a43115b59c937b66db63348ae07517cc14436855
SHA512 caf7cb061ad68b689883fc8c49316780c430b2a0640572fc53ede131d1c268441d51dff24acba31720ba6195d842f421948327f1e9adef0c577223337f156158
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7gQH:wUEtQevvqc2W1cpV2tI32Ey
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 867b8c4044acbd44704cb8fd513fc8e58df140ab8f7a71d5d4307d837e2c8158
MD5 7948bf15ca25a83e3ce7cb9019e87d07
SHA1 8f2a4e0c1dc441b769d3077f0a526438f17a1c71
SHA512 40193a29a7dfb1baa287b950589071b8edbcda7111f37504e5562e3d6dc81c9fb830c487918a85d3afc1f913261cf57d30187a8b4329a3d0077b10ce604266a6
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zTxHfJvYrPs9HHC:Loq2Vjnm6grExHC
TLSH
T19CD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bee5e16802ee0a2876694f1f379418a79eae0b0457dcfbd092d51f1513b991d2
MD5 a11916942c81612f058ac03e1fd25581
SHA1 ba7a967927204f9eb615293bce2a13c4a603d7fc
SHA512 89db798157c71a15244dd84c6de0b2a86361fdb20d140e1ae79394531728453ffa219810b262ab92acf615395d5ae0c194217c9f604638b822b26678e134c0ba
SSDEEP 24576:4AhGL3IFoiwtA5l7S53axHfJaMJWTTXPPC1X9qSH9Y6VyP:4AMUFoiq5qxHfJvYrPs9HHC
TLSH
T1BD35AE81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 af56b4396c01821e3736b3d3f771b9388839bc4a6f85fdbf2a3292716d7e2a05
MD5 00668f4ad33d523a3a6d82e1d64bc508
SHA1 f094f7bbeb6fbcea4bead6c5f39117c2c297d998
SHA512 d4213acbb4b923967bdc4ddb1e3e9476f2a301b5ebc5f0b5fafbf9e6442d2f5d02babdc30fa3bdf0054e74480678a9bc568f94c765fa86bf2e49c01016800166
SSDEEP 24576:owu4OW3xHfJaMJWTTXPPC1X9qSH9Y6VyP:owvOuxHfJvYrPs9HHC
TLSH
T1AD65F14676E90CF9E96342398597C135E7F2BC122A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 fcde9dd86f94022d8db35c5215658178f641b252b0e9cf3cb24ebe6fc98c0751
MD5 c52d52f752e557d9bea7609333bf33d9
SHA1 6d76d270f3db792cefca2a6ac0c962c0b0d874a4
SHA512 647da8f94456ead37042aebfbdeaba380f822217c1ca6cc6668e5ce81ac126e2df5412588c29ba4b625b8484dc07a66a6c36840ae92f3612d7bbb8da480c68d7
SSDEEP 12288:FeZ1IyjxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:wZuoxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B255125A36E861F9E663427D88E252048772786667B343CF1111A68B2F33BD15D3EB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 eca75c9dac703d1da1f138d3f6b1447b0e145f3ca25557e21b8c3fbf711e0812
MD5 696ea6ab45937628b38dbe6ebcc4d8c9
SHA1 9c5bd2ce5b861a66a976489b9528b2a54537fc8e
SHA512 d353dea246c8a22aafe7883617ccba4aa40d2e82a92c460a0376ec3c7cc6cfa352f19765173d010d1f882fc473f9493891bfa669123c180aaffb0d0777daf387
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:SQRQyi36YOcPbLvw2gAf+PN3JgrExHC
TLSH
T1FC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e76320df1ca2345e2bc2c11c062bc61ceeb58867185914a41d2707733f2dd83d
MD5 a7aef07fee12b52f041cd9d5c00f50f2
SHA1 9e5b7dc227f10ba4e2e05e47d3a823f4616e2f1c
SHA512 0168f8a2c21cf991e739e37c27bfa5b8cb2e1b432946349525e61e463c0b66ae62e58298d3ff942ec11fd9ce15d9625d6cf79ae22ecd2f137c5d42e4ee92f8cd
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Um:4QRQyi36YOcPbLvw2gAf+PN3JgrExHC
TLSH
T1B1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 216f27b1bf057c798f912fed2d7169b1595a32ee5b1a43517bffbbabf5d0a08a
MD5 59034edf90de53dc0fc03905bcc34d9a
SHA1 f6e1504f85d0d8cdcf691a9b71f5758bf6524461
SHA512 d47c6b8f4f287889f928fbadc6c624b7371568f8f830e2dd44f2638c8fb61654dca950d45283696e12c65eb77fb21d7e7b47bbf38811f4f709a855ba7ed9254a
SSDEEP 49152:p68Qg55nhceWu7PNU3/DxHfJvYrPs9HHC:3thLRc/DgrExHC
TLSH
T1A8B54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e4f78526bd1bd30d17eb99cb5e58d07baf19f6f8b03cc18873e4fb41aa243f6
MD5 e15feb93805245e701b80b73d6beb48e
SHA1 093061df07f544e5c64d7745a1a6500b52e336a3
SHA512 adf1deca6596ae25129a62799e9f8995d8235e6add15bbbe7dd9805da29a8a77a8f1cc5d09aa8b155bc5ea9cfd2fd6251a3cc413ab1f85087cf73ff521b8e560
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99:Ay5112gYy5azzVvt69nLKnhZ8grExHC
TLSH
T1B5167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 441a9368750d0668592c7ab652be14dc53cd49cea5a9e9aa57ec97e4cc53256d
MD5 bd8b17d82adea398fbea5ac30a33511f
SHA1 22e22bed3b7843d5af873887d03dc08f470a7f4e
SHA512 a6b2f39ffe61fda359d9d37fb5ddb8e1b7280163d678543aec8757ac6cf151dc5e30c043236d84505ddf231a17c37a5739d90a3144c01f7f847f7dbd36393100
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glcxHfJvYrPs9HHC:Ju6Jmdxd2dcgrExHC
TLSH
T1BDD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 666a557c7745a0a16666b5b60bed6efe1e3e237bfe5b10528ce03419b8069b16
MD5 180ab045ac10c7e2d414e85f8517c0c9
SHA1 76cdf227a0310dca4e9306455990856a96fe4a28
SHA512 65a314a55eedb5332e97685cc4c91bc0fa3092ffa6c5f607329e75bd9c26df60c1b9827c46183b8b151d33fef5d3f15f9d3d9e4650490e408f0fa457b7f3ab05
SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4xVxHfJvYrPs9HHC:4mifPWR6grExHC
TLSH
T16BB5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0b4d493647ce11fa63ded76c0146c244b1ee75f8aece8e7e3aa053aec709373a
MD5 a89a6eb13a4e0ec05097557f4f05c0ca
SHA1 9ceee73f128ee1f6f320a2a2fb59b5766038262a
SHA512 31207e04535ea6918d426e5a9b53860391b812c906a2934a451fc8fad397407f426d1609630d3917e45a7beb59274913e59196e136f70ca343153c9dce3d13ad
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqoxHfJvYrPs9HHC:65dKii61ogrExHC
TLSH
T1C7C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c67e85655cdd1c3d43549fe6a983548f3746426f1477c37e4fd0569b72a91acd
MD5 4e13b98d26d9a01b1b266541c1ce3c9c
SHA1 89fc3af70865fb76c3f124b1ec4f3e73cabe63c8
SHA512 9f5422d31de5773e4e14ec5d19c6af43109562c08b270f427d149524859ea312182952254a19b766dcb2f9c5d31e6cea53b89dcfeee6966d6096da3db47e7978
SSDEEP 49152:chtSn8EApI0fig3giDn0AP5wxxHfJvYrPs9HHC:dX2imphOgrExHC
TLSH
T17E95BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5df43c0f4bea1b5c0cd3926a6296fa6aa5a40414b9a6208b7816f59a7ffc978e
MD5 ec86338513ed3b3863463fecae4a332d
SHA1 36bca9f985e2c96b2e9b0c11e5578b5baffb55e1
SHA512 3a251ba1d0a99a57f9c6b9b4fe40ff9467fe626e22793a5d6ac2956046f95741b19e8e1245f46fba638e6fe3fbedff6f18b29a796db300050e6f7677f42ec6fd
SSDEEP 12288:FUxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:FUxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T137552316EDEF8379EA1103B6459253980856BE6EFBD3554A2003B84B377BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 5ea77c9b9b62c8fdec2e5a32c5b3c198b6e30b0deb03c089cf2fe7671d355a4f
MD5 4c172abb16eb9376c4ac965bab29fc2c
SHA1 18e077016acba1c903e23d2f094258172de467e9
SHA512 d1f7b2414194c3158283ad2d69c1d5073e82b4f6c00e290d7425454a75fd470621ccfb6966b11c4cbe0283f8a0072a3cf67369a8e7cacc446e913a7371e7992f
SSDEEP 12288:2fxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:2fxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E2552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B377ABE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7d454101912698f67d3985b5cd2c9ae3974eaec7270ffbef2db8cec07b0c931f
MD5 a6b9044838b1d40123b93d0689bd3293
SHA1 2d255b66fa4ab7ab406316a9a7603ceffdf7d9f9
SHA512 d460b09a95bea7ca0114ccf9e006e8391adab44ffb82e6360664db9f874a5fba06c9b8746b96f5cde001e6927bd7a2418583221b4cfd0299de696dda2fe90f75
SSDEEP 12288:gNxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:gNxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1F7552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B367BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 2339753f205cbc99f65aef4aa9d350f247a3e00c9a3b82b5bd5f6c0ac2182e85
MD5 d71ec074148d4387e00ccf76e3691466
SHA1 4bec2a9fe20310c6f158c5ff590701ae77fa1c1e
SHA512 655935bb8664583faab91cf1169b20432067ad5b2e36813719bb1076beb0b27562404bf4e8d03572156ae003ac1debd8c02ba3bc1afbb6b77f7eabc4a0f71b22
SSDEEP 12288:OV6xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:TxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1345523116EEF42E5ED22837989A352540572BC6EFBA3568F1102788F2F727E4540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 51f622848654ef72d99d16feeba71e62502dccd9572c749c909b8a686ddf98d4
MD5 c3b3cabe081da81f4d83f1b088696aa1
SHA1 98aa869bb74ab40dba6757d2db69bfb1cf62ff07
SHA512 e2167f0eb7ba5422f74193a8ad67867bf9ee90585d8c4b98d0379f3806e6d5b3ab8e15691be95b9fcb310b9b2499307f83d767a3d4edbb4a2932d77d76c7508f
SSDEEP 12288:/ixHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:/ixHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T100552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B367BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 33962853768d4341fd79a64c20f53c67b2ff4c8bd9c921be102c082caf92a7cf
MD5 07e886fe93b83256fd8a26e212ce23a1
SHA1 b11dc4a924d6cd82b711e86d9c7a34960ff7960a
SHA512 bf5754573c77be930dedd7bdd4d6815832c3667d21fcc56e1407435c705498c4328cae58b08cbda6d1ee6471366f2270a2cf6af960fea7958ff930813fd21741
SSDEEP 12288:KrxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KrxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T11B552315EDEF8379EA1103B6059353980856BE6EFBD3554A2007B88B377ABE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8ee040c4a917a88fdefde767dfca5f14a844b37fc016db3b4f198712ccd3d9bc
MD5 970f9605e3d28e0a479632d95b5709f6
SHA1 88ed7bb4bcfdc9e2f9ddc4af7bd375652977627c
SHA512 2c2c6fa5639a1e82dba68963bb3d86f1904ea9f534b4f57151a62f513887a2565913b60c600b46bf734fa1fe64460f3bc3e3d87ef9d6ef7cdba4a8e89656dd63
SSDEEP 12288:rHxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:rHxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10A552315EDEF8379EA1103B6059253980856BE6EFBD3554A3007B88B377ABA4500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 65d282d6acd08a8f0aeb49e859a7fde7b3d9a93a4f72a5915c5b10c362ed27ac
MD5 531fb1273877d963a992f23a5dfbea17
SHA1 8fcd539a206f7d03ebb126ce5a02aa19ebb05f69
SHA512 e44a20cff16c24b05c0e1769cc10099466d936367b9e4515990826f6f1c485d54eeb2a86cf41e87044a7c15123ed638646df0bcb2901ad3e28d9778452a59276
SSDEEP 24576:fZMRzFVSO/xHfJaMJWTTXPPC1X9qSH9Y6VyP:fZMRzfbxHfJvYrPs9HHC
TLSH
T1C5750295B39018F8EC63823ECD568905D6B27C5A5BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b4494df5594d4ddd8b1dc7e93331665423975bf0db268b17a6a35dd40115a3af
MD5 37982325960f05c00e9b1fbc6adf88cf
SHA1 7d15461a035f1e10de85815a0e5e991ddc96e627
SHA512 57da1014857fd0e0aa2b790cd3c240b7cbea13c253f053785b516f317c2214b282777b6862a44d14df1f719fa824e5d1d056bcf98e78dc2625ba8c35c87f44fb
SSDEEP 12288:dYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:dYxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T131552315EDEF8379EA1103BA059353980856BE6EFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a27dabb3e70de37a56e311f1d8ac57d0191d0b687911a93e3aae6a3e0b71cb02
MD5 d25a77598df90a6830ea78cd3f571ca7
SHA1 799b69f5b0368a3ccc7613a3d1af7dd3680e2352
SHA512 3360e497b0c7ebb86be700378c94761de11ca90ce79a8a38392dacc96c04e8b641a29d7fa1275b5ba48ac2e66cf584a3bffbb854e544929b49c445b9afb31574
SSDEEP 12288:bsxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:bsxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T18A552316EDEF8379EA1103B6059253980855BE6EFBD3554A2007B88B377ABA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 b60c8650b8d0851e38397ede31a7183491e45cb3a5b7c1f40fd0ad13f42972fc
MD5 4ccfd9e54d687b1a27869938eb15a432
SHA1 26d1d5ade85f24b990ab5a66f9840c8705d55dbb
SHA512 625119326655d3e8da04e0a0dab0ca6bd5a3311ab9bf3d217f530214cc42224e0b76cd5e36ab30280df5622758470d238f0de0c81999e977f0ac60f111bc9a30
SSDEEP 12288:RyPz5L8jxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:AzyjxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C865120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2fcb0a3a6b468f42cff225d8214bed75c99a942f743ff4e40f8f0efea9a4de18
MD5 c1e28c6e311cfbeb392d8c748cfdd4c6
SHA1 ec8915ca485631defd92f9bf69332a78ddb959ae
SHA512 4b880118d8c6b1d57aa3c002c9b887a1c6693b04f1e59a7c21d8ee04a53c9a1c6072726e21fcd7aac6692e1c35da0cfe4d0e1d0a59fca06db671edfc9b4c963e
SSDEEP 12288:BYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:BYxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T189552316EDEF8379EA1103BA059353980855BE6EFBD3554A2007B84B377ABA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 af1048ff687960a6c7bfb0a9b3aef284027a27c99a148d16881e319ce12782f4
MD5 e7ea97c6672a9999cbcb02d5fc6eac6b
SHA1 dda5e3a1f89ea8779a7477ce27cffb1fe84fd809
SHA512 610fcc1a31ecb8633ed2ed14fd8d1a161d9a77e9c4e6b21796fcd6dedfe5eccbf31bd8342ddee66e32b2b0603089e00adc5c2ffd399828ae5d4a2a8744d6a4ad
SSDEEP 12288:vYxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:vYxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E3552316EDEF8379EA1103BA059353980855BE6EFBD3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 695d8f56908fc5914bd4a7d64182c8024ba34297f91d9425e3333ada93c040c5
MD5 123c24108819e74cfb3a6e3e10cec52e
SHA1 a6b05d287c81e167a1bfb70e2683ec7f93981740
SHA512 af892f9cf73e65911f052c946a1f64e4402aeb53668d7199300628f617b26f6d2572cb89ffac9b349d01f882a2e992de520280aeb44521f1637fdca7597f0c2d
SSDEEP 12288:bbsfoxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:OoxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T16D65011AD29842E8D02E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\11BE.tmp
Size 414KB
SHA256 7083bba256b59c5e9ba62f700b858e0968169653cec8284e5e0c6e0098e9e191
MD5 e58c7d21a08f8038f2d69cbbae4e7484
SHA1 3be5356e6a32a52d929b3bd2bc13f234ae82801d
SHA512 e1429957e7a7c9fd8299d9ba451006351457e4e6b9485ee5ed74d427c8b2807270c101ec1eb57e1f20b62541655c8a615dc07056b62ba944cbc19c314e85d65f
SSDEEP 6144:+n1u7dN4R/tyONmaXc01FNoqgM01sBMxiftccUMf9uK6+TB8Gm1zSPqIAOimUo:81iyKONVnGP1sBMxifQWuJ+TWGC27V
TLSH
T1D1949E12E7828032D4FB16B0BAEA4FED93F9A4101B2954D7D398494E1F312D3AE35797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EFF.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\EFF.tmp.exe
Size 5.3MB
SHA256 58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296
MD5 57e8871e3535b84423314d7efce75a48
SHA1 858c4f3615513ba59eeac4ca851b2d9ec8ebc9bd
SHA512 f6086f87e138f88d022e2982975dfbbb13460a36c1c58355ff553d538d927836bfbfc81358b15883892e6a86776f7e6a8731fa0542e53267af94978d1be3e677
SSDEEP 98304:aajqHTgFRDKAVYXKbO1EFsNOnPBpJVwjdIG3rUUWVtZE8grExHC:aCq8PCXpTOnsdIG3TugQH
TLSH
T19D46D022BED14173E5A303319AADF77D647DE660072580D7A3D04A5A2D302E37B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52047695905883c7.bin

Path C:\Users\Admin\AppData\Roaming\52047695905883c7.bin
Size 12KB
SHA256 5e9eff1aeb9757acbe02e6d4584d9edb7b7c0a07d8f5f45ba7d02cfca5e2ce03
MD5 d719bbeb4e1dd94bb2ce6f250425374e
SHA1 91de3eab8e9e6a08f7f3aa13181f88046942681d
SHA512 4898b2e2ef5e5adb94e9da3e3df152966a8b0941293c32ccf1a74d60e287861725bb966b72906a6f3d3a2c292ba005104fa072bc72681fee87f2eb2ccee8b8c1
SSDEEP 192:NTVrrByhgEz61vyiXy4OIdrFSyAAFK3fnZhclxYP/Qoy0UHe3d:NTxrByh81vyiXy4hjbgvZhIYPdy0UMd
TLSH
T1D842BFBD4B50380C2EF68E87AC1C43601212A458FDD9C7B2E45366844C89C6BEDB59BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 48cef6a46494bcc756f29d55e6a378cf5d957a9a872c94ef77e572a1887173a6
MD5 3c0b984475b24d04f0671c160580a75e
SHA1 3a30acc37ea5dad56f19015edebac11cb8406980
SHA512 55ba72427e876eb70014f1a9a8aa47d23037a7b3dbe03a4a54b4c31bc6c35a761d69c48d6897c14c156db32cc03b94250847a5bc073b2b38e82e1187c010041d
SSDEEP 12288:40JxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:44xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1D5552316EFEEC729E931037505979228141BBE7DAFD3954B3002B48B3636BE1980E977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1a7bf1a4211f646cd82037284b6224e6e076ea7c3138457d0687e486a12c651a
MD5 0829016c1043f230743c072c202d30b5
SHA1 3f6f31532032e3d0aeae6c314815f6c083830981
SHA512 ad50ad9565bda742dfee70d1058af3b9cc546dabcf3a285aca53e7b262d19fc67ab7fb2fc1273e4ddb4738f0036477c5bfca017f60b4a223847651ab51d83017
SSDEEP 49152:pa0h2GEkuAe73q3pp46zwwQqxHfJvYrPs9HHC:pa0hNYG4Jw3grExHC
TLSH
T16685AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7bcb2cc7e9ea67ff05cbf00be7237ce32a21458cb8872aac4b56a2cb209270fa
MD5 f88a9b44f3f9b48891723301e4ba9eb5
SHA1 eb3888fc67c14a6da491915ab06130ddb48e8f02
SHA512 699505e12e72950a5389366e1927e6716224919cd09531e0ace0869e073715d85f590d9df5c6bb19da0823a65a9340e4c1c0a66f0336a9e94ba590691d624419
SSDEEP 24576:6hbHjPWxHfJaMJWTTXPPC1X9qSH9Y6VyP:6hbHjexHfJvYrPs9HHC
TLSH
T14955127E2AED11A8F531927D45928209C731BC29175293DF2282917E1F3BFE45C39F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c0f797298d2152facf10f655b43dd328291022d2352d6782580be22e52b23dd2
MD5 be09d20d6acc6abe868c238a71a808ac
SHA1 61b28d0c260a8933c9f5fb27159294f595ca4a2a
SHA512 61272e3d89cd3cb12010cde516caee0d234da7a26cebd62bfc6825ea2f26e5edb876f118b5ad332ef88f1ca2ba23f50daf047e75ae73a0060060acb1360305e7
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/uxHfJaMJWTTXPPC1X9qSH9Y6VyP:CIgnaTk46pBR/uxHfJvYrPs9HHC
TLSH
T16945BF2DF2F910B9D8A6D236450143B5BB71782D1F219ACB0170C538AF1AEE85E39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 412c0c190f46a03cbd1dfdff517b7c0bbf8dc733719f7f42eb5daa306e0a036b
MD5 e96ed8c12e6f1a69f310778ed4451998
SHA1 9392554a39262460bff5f744ce060a9e79af8f03
SHA512 b125adcbad56991890f3d62d1f69a8a7ae6ed1c1b3c959bfa0531bf4d0baf1ecff8e71ed499e9e9f5a26ebc443975144a01bda9c870a7d260bbed2bed65ef9bf
SSDEEP 12288:1IJxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:1kxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1A1552355ADEF9379EA2103BA059353580411BE2DABD356CB2003B48B377BBE5541E8B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 411592e68680e2338c4cce88afe1c5eb9f70d9a9f634280cbb9693c09beab169
MD5 aa345c528ba2afb649d354453586edcc
SHA1 de0e9d7a915133da06b21fe20b42d3b1e9b3cdd9
SHA512 5b1c654803cd543598005fb1ac208d86c49e0d3c4d51e5ec6c5cc38e01e027ef3022431b69cae781c7b375187df4383b003eb0d470e3b103cc6c86f74fca0367
SSDEEP 24576:6bL3UT1xHfJaMJWTTXPPC1X9qSH9Y6VyP:6bL3UhxHfJvYrPs9HHC
TLSH
T1D575F115FBE500F9E937823CC9A28616D272B85D0765E7DF03688A561F237E14E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 f2c852c7b51c09818bc68b882d278c253fbe771c9705c6ea77ad24ab59b43554
MD5 338af089aed5296e3406cca72a33e4d5
SHA1 a0cd7c68ac33c60e8bece9fe726d9568ace7752d
SHA512 8a41fa3d463643be720038beeea72f04aac4ddcb7b6d992cae200dfabdfe5dd777e0391ea12e98c9a73583cfbf3c6d193f670cb1a4effd3ac7bcca8636719ea6
SSDEEP 12288:KpFtIOfJxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:BOBxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1D055021A36ED11E4E535527D8993830CC372B8661B6257DF029090AF1F77FF86C3AA62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3a4944a5300d182398bd05c42365b3a5e6f5cc7a2f5c3064157f8e4ab5d0d0e3
MD5 ec6617cc10f006ecf8511bb5bac6aece
SHA1 0065789eb3e2efa7f76698609c3590aedd60a627
SHA512 2a3478e1f3fd581fa41772eb6a48e467c449c36d187091887a9edba8125bc947f620cf119d15fd31f481e2211252dafa51fa72c392d1cffe4ccea925be014399
SSDEEP 24576:T7NM9YqZqmWMUkPjZM48Mv6bEhsIxHfJaMJWTTXPPC1X9qSH9Y6VyP:T7cBWMpPjN8DbEhjxHfJvYrPs9HHC
TLSH
T1C7659E2E6BEC81E5D576D13DC9A28205F6B2B4611B318ACF1152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 4765f0585f86d5a00316ea551c0724147ceb4aa29cd870c32a81780ad29f3214
MD5 bee633054900ed9c53fb4fbc1105739c
SHA1 44e48b2c5ba38fd702a5d1bf1cb7535516f18a60
SHA512 70722cbc86e3fdcb6247ac14f08ef04f49745c0a0f433178a205de27f85dcd32668f5b065bd80699bef4eed0f479bfa58d367fc51236baea782e64c672eb9164
SSDEEP 49152:8F2YuHNETovAvNYf8kmoxHfJvYrPs9HHC:Z6BCf8kBgrExHC
TLSH
T1C9857D2927ED80A4E0BBD27D45B6D246FAB2B8551B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6ab4b5fe278fa31e374eafa0a536eaf85cf1bf1bbf4cbb901d5dad0a78f24aaa
MD5 234067b8308154ffb760707cce38acc6
SHA1 d57081b239b04b9f45eef22ef1aa36e979ea892f
SHA512 8dfbf6d3809d466c4cf68366a2dbb39462a5ab8e5ac51adf31fd219d07c340e215afc64a530ee6344478437e8a95f1751e149da9fb5b828d207f9922e28391a1
SSDEEP 24576:9AFs06+OmlfkNXEbTodxHfJaMJWTTXPPC1X9qSH9Y6VyP:yFs060lwXuKxHfJvYrPs9HHC
TLSH
T10365BF2F66EC00D5D07ED17E8997C91AF6B1746707225ACB0160863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 0278a3da9dc97279d36500a6995c8fb08276869ee0d53e653cf0195210040cfd
MD5 69e6f5fb99b9c50b59dbcc6910138acc
SHA1 583f0a5c087ed150345f504f0558794c100f703b
SHA512 af30d0b52be46358670ba8902c13003ad751542dfd56bcfcbb9821a3ae0cb6a0a137b1dd8bf0d06f19bebf51f5c5da33728b491d9c762fd92619fbb1b8fcca3f
SSDEEP 24576:IJnJ5D3WXKxHfJaMJWTTXPPC1X9qSH9Y6VyP:IJnJ5DGXKxHfJvYrPs9HHC
TLSH
T18675D02DD2A810F8D477C2B4819A1795BE72383D2F226ACB24B4D5353F22FE09979F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 65b6a7647a278875fd09abcf984bb73b409331093f976ecf5179b50735cdd4d6
MD5 a1a75a7cc04d95f2a96ce318edcdb6d1
SHA1 28efd25f5192c03f88549514f59beaf0bbdd4feb
SHA512 10ecc6304c15959ccd6ed3ef11162d5d47a0caba0328c69f653a40330107e540ec9e907d94b0de3aca7676af88e7300b8cacbe0a32daee11d550bb33036333cc
SSDEEP 49152:Zg06DIKdwc+eQnSt65aVsxHfJvYrPs9HHC:COgrExHC
TLSH
T196955C15BBEA5294E8B3CAB1C96291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 e095ac9884ed73d1d3d8379d067fc0ea86ee06584f569ddf915ee0206598371e
MD5 779cdce290d63c6bcbdb45bc938c97cb
SHA1 2e505e4b1121622741675322aced24f9565f1544
SHA512 36ffffaf8d7542b058bda728f2dd01d5be2f2f2ddd019d2f704b1a19c133cb926ba4c70e9b802102e2fa58a04ac4f39592ecc96d33af3aad1369f9ef20e3b479
SSDEEP 12288:LEP3Rn/xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Qn/xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T13755126D6BADA0E9D526823D85928204C372F4346B9327DF1192D13F0F37AE91D3DE62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 c08dd1abd78adb969d990072e113ae807e9c6994b354277bb45a045edf1c9d58
MD5 66c996519c744bfef6bdfbed23ebd40b
SHA1 e6f4e34a030da9bb1c3750569b6385d23e1a5df9
SHA512 8cdfacfed0d2fc898335b7e3d36fa25423f261b63058bf984e0d9540165c6ef881f95e6a4a9ba08523eccac8def16060629eada9eb626c22eac7eaa7b2f5be89
SSDEEP 12288:4jkyhJxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:4IyzxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T13C65130567D99194EA35037889A382944E35BC34AF6253DF2081F52F6F37BE46839F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b042d634eb9015d8b1e8a6e6454ba73c51752ccdea87f71f9dc4bbd7f6aeeae6
MD5 125b9c5b6a259c49c11cfcce30d59ff7
SHA1 4742bc945aa61e1a4805925fcc9d1783b4e7caa0
SHA512 906ad9a0e42290cdd5a760d88b8dce8f7df55ef6a817d3ccba8f4433ca952c34607c4d64f5555dc9d6df6d0bac7b76ad1b7ab00446ae3fb07f884f492fdc964f
SSDEEP 12288:8yPJxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:pxxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T187552319AAFFA279EE2103B90593535404217D3DBB9325DF2082F49B6777BE1501ECA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 aa42e11054af16e815a9cc4ed49300419990ee2d629048e9a88fdb7734479b4c
MD5 65640fc95c0bc918013f98b8a2f968c1
SHA1 09dddf9b920232a94766d2100c5447ac4d0b8edb
SHA512 0e1912bac7b0c404189059265c296ca24868affec1dbb7fcfc93bbee789aa3efcc1349f1042b729200204db017d02dfcf657db7bf5ee0f3ea547595fc1c3a314
SSDEEP 24576:QQ9MxZKdcz9dw3QxHfJaMJWTTXPPC1X9qSH9Y6VyP:QVKZQxHfJvYrPs9HHC
TLSH
T1B6558D2DABE9059AE173D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 9fca3900853485ceed4668e152e9f01a24d4bd0c46deace2e9c058b6458279fe
MD5 266efb340333e44b238e1110707e2766
SHA1 47feb982cbdd992ef1ad7c126327731aaf08f672
SHA512 c02ea6c1b586cb5d5c198eecb5d5f8061644b56bbf3dc2bc1d6623cfc7436431c2c8883c7f4eb025bb0c935803eff910cef027eb3b436a1af421e4a0571e2878
SSDEEP 24576:pyocDAp/xHfJaMJWTTXPPC1X9qSH9Y6VyP:EocDAp/xHfJvYrPs9HHC
TLSH
T18065E01FBBAE40A1E122813C89858344E773B4345B6257CB2591C73E4F37AE9BD39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6c6c7481b6c81863355b16ddc327fde3af289e1b522ec9b49bdd9fcca692ae8c
MD5 3a431d77d699e088de172a43c4c7b5ec
SHA1 07a22b7ac10a9779dbf86f4a82e61795c6e5e2fe
SHA512 3e5f304dedff7104b84b02f322620037df14b2a47626436fe0bf227b2a4f1d814e93f64c60875f7b209a110499f5514c80bed964eb3dcd306d1b16be6c33a241
SSDEEP 49152:pWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK/xHfJvYrPs9HHC:R0zuNI1grExHC
TLSH
T1E7A57B3DA2BC00A8D9AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 81179273ab36e0834e40c1205e6cd154f0fdab78268d2d808fa2f2bfba1a8a5d
MD5 0682fe3f921f01703279b9adcfd760c4
SHA1 bee5b7b57201c615c8b2f37599b9bf9494dc46da
SHA512 6702e0f832b90752ed0ba1a3d971c20feae02d95106c83da196bb05cfa0c13c7e09b2439e8405721ad07103cfc12b5c683e5a04be48a220b938a3c04e8ec1882
SSDEEP 24576:n1QT7EcpfxR+N5AWAz3ooiYujMqb/xHfJaMJWTTXPPC1X9qSH9Y6VyP:aTDxR+N5YzT4jM4xHfJvYrPs9HHC
TLSH
T19E55B02EA7F915E9D17E85798A23C502FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-354-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/332-302-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/512-96-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/512-49-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/608-425-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/608-393-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/608-360-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/608-524-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/608-430-0x000000000CD10000-0x000000000CD18000-memory.dmp

Download

memory/608-409-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/760-273-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/760-342-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1068-351-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1068-522-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1248-309-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1832-291-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/1832-296-0x00000000008F0000-0x0000000000956000-memory.dmp

Download

memory/1832-298-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1832-350-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2076-305-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2076-359-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2076-498-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2424-343-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2424-515-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2992-497-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2992-334-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/3132-250-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3132-41-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3132-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3132-47-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/3188-206-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3188-84-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3188-90-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3312-261-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3312-268-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3312-267-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3312-338-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3704-429-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3704-311-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3704-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3704-318-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3760-248-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3760-15-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3844-19-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3844-27-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/3844-28-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4020-0-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/4020-75-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/4020-1-0x0000000002880000-0x00000000028E6000-memory.dmp

Download

memory/4020-8-0x0000000002880000-0x00000000028E6000-memory.dmp

Download

memory/4076-459-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-436-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-451-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-452-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-453-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-454-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-455-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-456-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-457-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-458-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-460-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-461-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-462-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-463-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-465-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-433-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-434-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-438-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-448-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-447-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-446-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-445-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-444-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-443-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-442-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-441-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-440-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-439-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-437-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-449-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-466-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-470-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-435-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-464-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-471-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-450-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-469-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-468-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4076-467-0x0000023501F70000-0x0000023501F80000-memory.dmp

Download

memory/4152-339-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4152-340-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4648-516-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4648-347-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4804-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4804-95-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4804-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4804-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4880-284-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4880-278-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4880-277-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4880-346-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/5036-76-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/5036-62-0x0000000002580000-0x00000000025E6000-memory.dmp

Download

memory/5036-251-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/5036-57-0x0000000002580000-0x00000000025E6000-memory.dmp

Download

memory/5044-355-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/5044-523-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/5092-330-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5092-323-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5092-329-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/5092-432-0x0000000140000000-0x0000000140259000-memory.dmp

Download