1d194414085ee232a1ac2da9a4ed689d296079ef1ac7d4c81994357ceace4eab

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 9.0MB
Sample260723-ff2vdagd49
SHA256 1d194414085ee232a1ac2da9a4ed689d296079ef1ac7d4c81994357ceace4eab
MD5 38c7c08a3c596ae840df831da8343e94
SHA1 a99c4d4908469023ce1d474675978bbe38f33a30
SHA512 a8d4a1ab751f5f4070f5430b0c2d6e7bae38125259d60df8173654a399c765f8b1c59da523ad13eef6e06e8dff5355eb03ecc43988021e0de37a3c79f7f979d1
SSDEEP 98304:qa1uEQENDIlRytlzE4xfG36QsGJVL8EJNbOL6OEJ0pdvMbireiRedMV7FToGB2Yk:qSuE+ytlEOfGDsGH8g9azre8zZ
TLSH
T19496AE31B601C136E9D20071A87CDFAF562DAA350B25A0D3B7D82DBE68B85C31739B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4480	alg.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
5684	fxssvc.exe
1448	elevation_service.exe
4904	elevation_service.exe
2268	maintenanceservice.exe
5556	msdtc.exe
5348	OSE.EXE
1824	PerceptionSimulationService.exe
1260	perfhost.exe
552	locator.exe
5744	SensorDataService.exe
1696	snmptrap.exe
4792	spectrum.exe
5592	ssh-agent.exe
4912	TieringEngineService.exe
412	AgentService.exe
4988	vds.exe
1456	vssvc.exe
1936	wbengine.exe
3200	WmiApSrv.exe
4784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f3204a685a3b5d25.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\SwitchStart.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002f2079c75e1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002b328cc75e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000edcf89c75e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000770c85c75e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a4861c75e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009488ffc65e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a1814c85e1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4776	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
4776	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
4776	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
4776	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
2960	DiagnosticsHub.StandardCollector.Service.exe
1448	elevation_service.exe
1448	elevation_service.exe
1448	elevation_service.exe
1448	elevation_service.exe
1448	elevation_service.exe
1448	elevation_service.exe
1448	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4776	2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	5684	fxssvc.exe
Token: SeRestorePrivilege	4912	TieringEngineService.exe
Token: SeManageVolumePrivilege	4912	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	412	AgentService.exe
Token: SeBackupPrivilege	1456	vssvc.exe
Token: SeRestorePrivilege	1456	vssvc.exe
Token: SeAuditPrivilege	1456	vssvc.exe
Token: SeBackupPrivilege	1936	wbengine.exe
Token: SeRestorePrivilege	1936	wbengine.exe
Token: SeSecurityPrivilege	1936	wbengine.exe
Token: 33	4784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4784	SearchIndexer.exe
Token: SeDebugPrivilege	2960	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1448	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 5300	4784	SearchIndexer.exe	112
PID 4784 wrote to memory of 5020	4784	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_38c7c08a3c596ae840df831da8343e94_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:6080

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4904

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5348

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:552

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5744

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1696

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4792

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:412

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3200

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5300
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8eb92d14b31142f09795bce8389187230da7d43e2c942f1fc7f1b635d6991552
MD5 eea6e4cf9e064103d314913d1e9e8b58
SHA1 f6ef6fabe13e969a7084a579012023cea5afc85b
SHA512 d870bab2a2579ea298d55fa327871de30e6d99cc548aff0d74fb27a4ecf7d55dc4525ddea4ecd4ee1e8ea022a40a8ba0b0269c6c3c8ff8ad0b1f2dc33a034227
SSDEEP 49152:Qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFaB0zj0yjoB2:63q6HjBzB2Yyjl
TLSH
T1FDD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ee030778bd77fcd20f9cac711695991dc58bbd09d338793c6cd84dc6550c6eaa
MD5 c573386d61a9ef736c70a1fd13c240b1
SHA1 5fc768543bf17f815703104cbd487eec772443fe
SHA512 e44a77a2e9cfffc8e7e226aa04241f9ac227cfd34b192541487adf967d3ecc4a86926a4139873f62dd3d34105fa21d9a928300e0d5ecd9e4d69559fe437b6477
SSDEEP 24576:yXYfDtczAwatr0zAiX90z/F0jsFB3SQko:Ztc/aB0zj0yjoB2
TLSH
T1AE650229779504F9DC67823CC9A18506EB73785147A0E7CB03E4AA6A5F333C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c40f36051b597c5a5e41f73ec91ea29296106a7edd44289d1eb63fae08692088
MD5 ae57c69f6c130107a3a033b7c3719d11
SHA1 7aaa716e1772324352dfafa1e12c347b5bcf7bcf
SHA512 39f87d4fbcf3525a5764415bcdff6432b4c1447550f3dd9f518fe887a2fec81f82f605c617372b310365480a2d30bdd6ac2ffa4bdca9694070e1914cfc63a72e
SSDEEP 24576:W0Le5ji0hmxirMNatr0zAiX90z/F0jsFB3SQk9:WPji0Ac2aB0zj0yjoB2
TLSH
T136859E16F6748371D073C0B9C5D2A68EED72308657308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16d8bb8de3bbc8974c7d63255b9ee887daeed37b2c12fbe9a06c2510923e4a8d
MD5 6e35b258dbb86158bc2bbc3256b24d1c
SHA1 32f6b698915d1106dbfa64f7477f0d0f6d6cc8b5
SHA512 ee62d9a87281c1226be1a3d0972be4837099add210986ad57b86158e880b43535dbbce6ac2ed4403596cfe2d15bf5ef0c54d09675c2a5a77bc8cc0029a931adb
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWE6q8wyuPatr0zAiX90z/F0jsFB3SQkh:J/ezSC6vUzPvxHjyKaB0zj0yjoB2
TLSH
T1BE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 179a8dbda1e7480662568cbd855064235d7e755ba90ee0b422db6e87851ae78e
MD5 869ea6b189b6d004251cc34bca464502
SHA1 7bef1e2e22898abe263d9c894f81fa13cba8ff0d
SHA512 e5c0044b464e6ccc8dc3fc9da206f2ba0fe34ba5309faa591350c2c3c812272b4a1a6b40aa7366ff93e0986f30685b05011261388abc262ffc5167b81ab181b9
SSDEEP 24576:ZVbqPb88hv/l+6Matr0zAiX90z/F0jsFB3SQkc:ZVO88hXl+RaB0zj0yjoB2
TLSH
T1CD55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4a0a4339b98f590bd025560f685f224fcb5485461ec9ea181fdb78531dfbf0c9
MD5 252b9cd4537f94e4e0ac4e948f875d34
SHA1 84b7485eea61cdba8404e793152c6af319ec8def
SHA512 b94f0242c9b6d31521a08fd3868b32b2da02cf29443787ec9ce40365a49e7015f76e97155e71a014a69e507b95a5db84f5cff924e43ec30894a04f3589276e0e
SSDEEP 12288:rRpUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8y:rRpatr0zAiX90z/F0jsFB3SQkl
TLSH
T1CB45230B341E80F2CDC32B3526989C4B1AB99EB065E2AF45E2913F4F9D3C2C695656C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d7a49400bb1220adcd86ddff53d2241a7abe5f26a4b7824b2c2c747a3cec2c46
MD5 50764237f333f7318f3ca4b17d35608d
SHA1 a68472ea70879cbc62cbe3b92395c2132d446811
SHA512 a24138b45a56e35b25e98a48f250756644786d5e68791bfce9bde5bea09700beb1bc1806cd06c1ae045e611ba5001facf4195b121469f9147ba8c1cd545a9fc6
SSDEEP 12288:QeBNUbTVO86U0UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8B:QJIU0atr0zAiX90z/F0jsFB3SQkU
TLSH
T1A265DF3BAE28FCE2C27A4D785B91C600D77278704B62A3CBD165930EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 14bf060bf4ab341596fcb4a93e4b2567129369daf4cdce720c893eadf4f1d1e0
MD5 9d1ec27f2c1f45605583291869a67db5
SHA1 998840c8b3977c3a60a708112e9de5f43003b5de
SHA512 d9139f1ab07907da18ddece91ecec70d071a475da24fdffdcdde66a2febeed96181df6c26e217826fbbd52267e0c42541a0dd6b9e548941da6e98e085ef7b74a
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:GQvGAdlCEL8c/yRNw5CSB2Yyjl
TLSH
T171267D656BF880F5E0A7E138897AC572F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 906d3c9efbc0c9b954f53ba4b9010984e5e78c427888f722ed0ae72c77856e87
MD5 96839dfc7aa082fce1652701f96dd8a1
SHA1 ca4993528e2d25120ea4c27c2067f5be5f662218
SHA512 e6dde89132fcc8961ff499c8fa8993d198b9891962d02a0f25ace4b6383ace48e770ff0274a5d0d610b5be545d1972db7b616e69ac31da3ba5cbe07bdfbeedc6
SSDEEP 12288:LAwSfxL/2Dc34DLLmt0LDQewsAjGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHF:0dewsAjGatr0zAiX90z/F0jsFB3SQkN
TLSH
T15B75E031FE75D032C6BB0DB61B25C706147D7A204BA21AC3E3E86E8E59342D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a060cf49684a2f02dbdcc61f2285e473392d7f7438ae3d6632fac27113c08750
MD5 706cb0a3d42815eb42470c5b2484e64a
SHA1 72f35d0f42d73ed4d982c8c8bc10261fa7223845
SHA512 f924ea9c2742e573367b0d58b872f4d6d4f418cd4478c523dd48c48c6ad76f001c6197044a25cc1462cc40e50a7fcd7509e6a1327de607586d1ad11b435babee
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJZ:IUEtQevvqc2W1cpV2EI327
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b7301e4dba85d57761b26b76640e8a41563f8d7ad5d305aed520eac2d6f29e75
MD5 7b0307c9435639352d336cab303f7a55
SHA1 b57c3ba43fd9a735d3278fa4b7bb88678550025a
SHA512 4f29c83343d13a6090ad144e2f4327c5e70933f5d7ffcb18bf69185d2fe4b1dd799f6c047b144a306fea17aae96daeca331b45634069784bb845c4ee70874982
SSDEEP 49152:NCbRquA/m2yL5zQfFiV+XenmE3/zmaB0zj0yjoB2:qoqtVjnm+B2Yyjl
TLSH
T1CAD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b965a03a0be012b1453996a7681ae5ada7797214b901148280423ac746b74747
MD5 3be10e34b882f5e05f792cd2157211f9
SHA1 f644e87e4c9ced07a0f9b655fe3115f51c9f36c0
SHA512 2f078704c782d934a2b1e056f5e98c7b13b53c7b3584019f354588f1c34c392d65b0cb3671ce2b62f4c757db7ed7d873f11a4d444f412b56eddadb3f3b8e2a2a
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53Tatr0zAiX90z/F0jsFB3SQkM:ZAMyFoiq5DaB0zj0yjoB2
TLSH
T1EC359D81EBF955D4F5F3AA7899B58571EA76BCA55E31C20F2160D20F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2c1bcca3a595a217535aad745977f8b5fa254c236af0d8162d53bced7901cb6b
MD5 71b64d6d6e494bc6c7f0a00db86143a5
SHA1 e9ece614c3c418b7a4912f86a1bfe1a282463c13
SHA512 f7e22160e3c3d75284ed2334e792ca433f116967083dbecca239cbbada55a9178edbff08162bd6d17654948bc999eb173f73d42d72d65aaf20edb1ec1dfb2422
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:KwuoOWqatr0zAiX90z/F0jsFB3SQkU
TLSH
T13165F14A36A90CF9E9A342388547C536F7F2BC112A61DB1F1360CA5B5F37351AD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b411a8eb24aa6ea8ee94fc569557009d459d4977640476c10bd45963b81176ba
MD5 3b8d4c9cc239582fb1e17fbf5e80b0a2
SHA1 eea0e4c0f6b87c553f3c1075c668c7ca4ed52c1e
SHA512 75731489a3d06df7e5c6a18f67853d798a960cb17af31a27faa084e70b882bc9a230f892b9a33c018b41d60343376543928def8a31f089c0034c979b1b2c44a8
SSDEEP 12288:rBZ1IyWUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:FZuVatr0zAiX90z/F0jsFB3SQk1
TLSH
T1DE55124B32A960F6D5D3523C89E4490AD7B2786123B283CF12607B5F5F36AC25E39763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0d64b26f3bc18ae51888d50ab258d53cb56dc38cfb7e9334256544897adb8288
MD5 1ff4b59d549a39019232562a9dcd9b46
SHA1 fad0334d37ba8c6a3d062607fe0bb54039f08789
SHA512 6d376a24c0c70abf3153a1ec1ecffd11c2d7976d920862b2b2c57699e46c8204410ae8bf81ea4031ec173022b728ff5119b3af2284683ae0568c0c3f46c51722
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:UQRQyi36YOcPQLvw2gAf+PN33B2Yyjl
TLSH
T1C7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6319f40d2d5b1b8a9a632f9a5f67c1c3ab6df9c71819212e84d2cee0e5681c00
MD5 b3c1e934c3f39c8efbd8c24469d2044e
SHA1 7991fac8de2a97b905a65e0ecc8c625b3c24115f
SHA512 c459397699930be1be8b385cb0d4bae73e10b41cd25b4558a211e43b93e6e26bf223e839db424c9abcc38da35e7e418d9b7a2ef1f7dc632b26f9821d177e9f95
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:0QRQyi36YOcPQLvw2gAf+PN33B2Yyjl
TLSH
T1D9667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 72b60fd5cb5b25f2d5342c0e7ae5742b157780d655c87b5b05747e719379075b
MD5 e38677d7938489e55e5c18e00d92a32b
SHA1 bbc1f998fa9d10d4c8525b97ed7d7f1914377be5
SHA512 52c4db3cbcead603ce1e24d540b9157adfb73b3c3da7011c6e343e77c857d9039fb1f6099e588f204e9c898540f3c1ec5e9cfe97ebea3c9ec21a7ed6db96ee55
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Fatr0zAiX90z/FR:I68Qg55nhheWu7PNU3/2aB0zj0yjoB2
TLSH
T139B55A33B2F600A9C44DE1769F4A872196D17C758FE1E3DB8151720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 561e51b1323c7c0dd52261e7f6b481971af6d6a61085a7d6687a1377b24e4b2a
MD5 4c14b39be3ca09135cffef7fe832e444
SHA1 347679fc149a1966f94cd3d366d50dc2988dd392
SHA512 0e4bd38a1e7afcc98a965abe666ff0443c45e281832acb2959f515f7a2c1f13c9835d31e2b6553e5383f008b1b6ea6e923d49f4e5119873ec4200e3c1f1b0b67
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:Wy5112gYy5azzVvL69nLKnhZwB2Yyjl
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eab435928ce1e02aa5724a8a3d72a626ee5365dde9ed184cfe5a7846781c2197
MD5 50a5fa878c8131d55bc577002549b439
SHA1 c7abd598e5040cb19bbf076d88463164687bc6bd
SHA512 cb37a5d562e5bb377d80953c737d98a541555e795eba6f35b7c9c792c3a23845bb14bad6462ef85e5c4aff33062d3f3e7819aa42b7f3b9ee4b92f47b796ada68
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgaB0zj0yjoB2:Vu6JmVxd2d/B2Yyjl
TLSH
T1FFD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5421487b3b835edb9ff266ac05509695679be9667dab2dcd8ef8ee54d1931f56
MD5 228d191e90691f5dda3fb0b82a48419b
SHA1 517b477ed23b75348e6df4f2cb64ac4a42835c4f
SHA512 147b18dec9132663279efa72e0ebf15f3b000c4509aa7b5d9bf1f1ff2bf2657cdcc563771194d6422f0b6af11c613170828a6341309747b04f40996c179d8955
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xUaB0zj0yjoB2:kmifPbR+B2Yyjl
TLSH
T1FDB5BE13F29900E8D05ED17887569632EA72BC460B31B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 23c6c48204d19325683e665a40c605257b55aef0a52ebd9dee85e26b2c542033
MD5 1a8b933ddef6695d870bf6b8ce0d4111
SHA1 aa826f4a9453e39bac1ac47bc553edc7805d9c8a
SHA512 d29f3e364097d26a2499c65c46091928929fb7f9e6648281439d80259eeee9ecef724fb31f7263e42aa3a7b54368bf5c8048eade8397ae33c84b23fd379d5483
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqVaB0zj0yjoB2:U5dKTi61EB2Yyjl
TLSH
T1F6C5BE03F2E940E8E0BEE67487659632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9fc1d948322d073479a0d17d6ed2e7d248f2dfb1e0fbfd752a1171ab4716cf9
MD5 ddb5dac0326b7c709e1f62e8924af917
SHA1 6f987a471d0b21a741a4ffa5819f312ef514aabc
SHA512 38c46766418d5bea23d33904bb995e46d132819cb3c189f685fac4f97a4b517ac6d8eae96d5a3e30687c15836ef506a980970f958ee1a353b4733816c2f7254d
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wwaB0zj0yjoB2:lX2iyphKB2Yyjl
TLSH
T10C95BE13F2D900E8D05AD178C7468632EA62BC150B35BAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e44955ef91da1d8c06cca0ce800e47a6dae90e6ad292b60062cb723d63b953a4
MD5 867f81e1a7a41f79c5157dfb4ab116d1
SHA1 60a793d9d2801a340fec16b33a15d065a1b740e7
SHA512 1125816e293bc4250479eb31849c6b2d53964fab9ea6afe3dd072db5a9fe591e15ccc166b7b2d58a433df2036af0c1994133111c8f0bee3b6099ec8d98f99f19
SSDEEP 12288:6RUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:6Ratr0zAiX90z/F0jsFB3SQkG
TLSH
T1AB45230B341F80F3C8831B355684984B1AB95EB4B6E36B85B2953F0FDE386C715656CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 74a58d6c7da3573f0300014e8a5f9ff39d0a354361e9106fbde8cdcb89bddc8a
MD5 51c424bc99dfaa8f99209e3c5ce90f4d
SHA1 87a947ce69d64c225bb8c487ab0be802fa0eb1cd
SHA512 5f309539a6ef8bba0fa3193f27705834bb6273d51008468f09b1cb20ed0b777af7d0ecfecb1c0b0448a9d310538ec72aa6521a48ae26ba976f32be9449b3cf22
SSDEEP 12288:oiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik83:oiatr0zAiX90z/F0jsFB3SQke
TLSH
T1B245230B381F80F3C8831B355284984B5A795EB476E36B86B2D53F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cc290bfcc72a54bbf14e60331315eeca2f02ff3740a9f6e16ec561d8e1914878
MD5 9aa291f9f6df0f3aa5243cdc3a5a2051
SHA1 32ff8609402679b194b3b34442264ffa2805b372
SHA512 de041f224092044b52556745b51484e247d7a3377dfe51657a8f2428b83b6afc9e084d078a43c6750c16a2bbb6efec2361383937935b9aff2351466eedd4a7d4
SSDEEP 12288:r8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8r:r8atr0zAiX90z/F0jsFB3SQkq
TLSH
T1C945230B341F80F3C8C31B355244988B5AB95EB476E36B85F2D63E0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9232b7c5cfb2660f8ff25091a3b4bd2b66a9ec4575fd2355426647911de7ed78
MD5 27b5719389fe725579d026d4e2bf7078
SHA1 712979b5678fd4c4419a30e5a394cb6a5b8b14c0
SHA512 a8e240a5d300df2fc197e90e381d0d3080ece67a13101f6c0989c77067d12fd1061ea6d571e088abbb494c32bd16a49b72a259c288aecb4b68d9c28be6fdfd18
SSDEEP 12288:AVzUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8o:Eatr0zAiX90z/F0jsFB3SQkR
TLSH
T14245230B351F40F2C89397358694884696B9BDB4A7F3AB9FA2413E0F4E343C56934BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d9c771156fa48b8494dc9cf4a646acdd8e434ee4ed0266a143fa931f2a3090d9
MD5 fd281b8b5282274bd79edbc90c0d603c
SHA1 546db02e7999bfcc82043b052efff9a514c41107
SHA512 b1830179f59a84be48f7cde96c4288c10d83bed302623b642d7ce2856b3d8d63761f0c25b6c14b0fdcce407d0b5d07be991357d7d2aa25680b1380efdb514007
SSDEEP 12288:/LUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik88:/Latr0zAiX90z/F0jsFB3SQk5
TLSH
T10645230B381F80F3C8831B355244888B5AB95EB476E36B85F2D53F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a4a212097f71fd63eccba0c17209d387cbd6cc115db93217c4e6613d8766989f
MD5 0ae1658b38dba50d85d3d3ea5a72ae10
SHA1 3ea500464fcd5d8e0ea004d4c40717588122ac4c
SHA512 76413691213ffbdecdd7db3e09761607aaa1685bce4e24d16eb9de44200b6a2a4d29640fdc5ea292abb967e124aeb0c0d2337d423ccc385d3fca0126a1948896
SSDEEP 12288:PuUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8p:Puatr0zAiX90z/F0jsFB3SQkU
TLSH
T13745230B381F80F3C8831B355684988B5A795EB476E36B85B2D13F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b17c822e44799a1e109335b501a0467f316e9ce2f629075d8934629c325c912a
MD5 faac5a2b2f553ed3d70ec20c2d146e96
SHA1 42c21ca40aa5f866e7911413c847a095db376ed5
SHA512 98340b7a08affc355153ec87c79c146a515a9f17b0e71f1db68e8b12863d57c2f3bfe2a4b3d5fcbfefa7232eaaa4726341dd2e69cb9f5e1dff8c8508648df7f0
SSDEEP 12288:FaUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:Faatr0zAiX90z/F0jsFB3SQks
TLSH
T17245230B381F40F3C88317355244984B1AB95EB4B6E3AB85F2957F0FEE382C725656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 63543e14bca19190623d6a10d919bd684f8d39c21e7e03495b4d0872db48b2b6
MD5 a6a60420d4ba8d99d77598316c866e40
SHA1 edbfb00a5a4e1c02b523bb43e5b4143543d097bd
SHA512 67b66c91c8d4a686b46925abeb48c896d203133fcbc9320224784168f3d7dc899b93e4422853fd2808656ba26f3f1d6f1f4f974806ccf7a87be5fca1090af362
SSDEEP 24576:aZMSzFVSOCatr0zAiX90z/F0jsFB3SQkY:aZMSzf+aB0zj0yjoB2
TLSH
T1EB65019A735108F5DCA3823EC9548906D6B27C6917B0CA5F13E43A2B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 815f465f87e739d2f8fb7340c4acef43d63a87e4f18f60c6a8b136fe6fcdbc57
MD5 61984066dffe17014c505fbf2080fc5e
SHA1 f861ba3f8999e041a6acb89a30ce1b0d418d2831
SHA512 23bcadf1dea98eb1e7c330e54642cefdb7ee62d5c2d180e492c190b156e4256dfcbe1a91a0f61f1992875b1a56b5bf769148cbd9a155b55fd3973b2c0c4c1616
SSDEEP 12288:nlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Y:nlatr0zAiX90z/F0jsFB3SQk1
TLSH
T17045230B341F80F3C8831B355244988B5AB95EB476E36B85F2963F0FDE382C716655DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0b27e58f45364c73e10360b42a5b3b0e8449c51f7030c9c6da14bdf6230f59ad
MD5 2616dda3cfff1870859ec1979ea31407
SHA1 2b2ba2156cba8e1d4047963661359d98ba3d910b
SHA512 096bd24b6040439e1ac94b9cb7008bfdaa4089cd0f47363e0c07da9b395811c24218ad620e27875449272f0580ec3d796ec0ef4268c933b84671b7d73c6b1be4
SSDEEP 12288:L5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8/:L5atr0zAiX90z/F0jsFB3SQky
TLSH
T1A145230B341F80F3C88317355284984B1A795FB4B6E3AB86F2957F0F9E382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 0e2cc24fac8e3f1baa24006ced54c85cdeca5bcf5be18efd420c84746a14cec4
MD5 d9d2bc72e5134104f26cb39756e080c7
SHA1 d7be955e4c975a180d1ccec723a80b9251ae3fca
SHA512 e614010012c5b76a3d75b7429db54ec735b99ac0f7d1d0384ff071bca449c1440ee1d887defb7d51173df4d3044f0968cc1184bbc97d57ff04f2b6ba8eba2979
SSDEEP 12288:hyPz5L8WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8b:wzyWatr0zAiX90z/F0jsFB3SQkK
TLSH
T1B8551207326620F9C4639238C9911906F775783117A19F9F53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b10232c38b3c40059bca800f9f8f87acf2d8cfd8187d0a2d67dfe53f4bf21ff6
MD5 740b481ae591a778afbb5d57c30af072
SHA1 6dc6a29ba682fc33bbc5072ec7c85ea0eaf3d4e4
SHA512 b6d4c516a1a6e2abef13ef99f0a8e5f3ae1a766212e33c360c00fabad13e57df013b87ce2b6003b82841998258e969b3742e0a0d7c3360ed4dea595aea9a7a87
SSDEEP 12288:GlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8h:Glatr0zAiX90z/F0jsFB3SQk4
TLSH
T13745230B341F80F3C8831B355244988B5AB95EB476E36B85F2D63F0FDE382C616656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e4184b9764652c5791fbd0f1399398b6761bad66add851bcde00881d495578fa
MD5 12e5eab19149ad4d64938016fa092613
SHA1 7ef4ac41ed2bcddf6b82f564d837f20d0c0e08de
SHA512 c7ee8d0df1ec0f8365d4799e2f4d103c0ea6922cb604e20f1233e13a5fc6a400b39f29a39215e913cc5d69b9482a79002fad052e7316ef7c774417d4681f58c0
SSDEEP 12288:MlUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8t:Mlatr0zAiX90z/F0jsFB3SQkM
TLSH
T18845230B341F80F3C8831B355644988B1AB95EB476E36B85F2963F0FDE382C716656DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 95a26ec4e8fd8759742c7a313fff0f8596aad56db577960a250965c2f8b2e3be
MD5 fb60344e0dfed612f66b24fe326bb895
SHA1 7a871f92a3ea5ed411aca41291a99435ba59b685
SHA512 2cb9ffb67eb056ceca94fa9c472fe4bcda06021733a67051b09f6d86bb624966ca370b0890da92bdbf91efb546a612e570aa0fb8bd3829f40b3edc00751f7982
SSDEEP 12288:KyPz5L8WUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8j:XzyWatr0zAiX90z/F0jsFB3SQk2
TLSH
T135551207326620F9C4639238C9911906F776783117A19FAF53A02B7B6F372D15E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9f6b414f53fc48935f1222631e4a8357ef343d8a9d7a4e4fe5177e98d1c0dabc
MD5 a9ea1e6b897a17c53e3e801fa91cf973
SHA1 f114e5292088835bccb0038fc14bf825feda38d9
SHA512 c96de36d646b0524c8fc2f055375ca1fdc37d420fa0037124a3428b7c67253a8994742a856c1247da2e75a662b45b907c2db3c1a5b6a8bef6698a029bc8c8f03
SSDEEP 24576:xTHaLl3z0zDsatr0zAiX90z/F0jsFB3SQkh:xT6LljPaB0zj0yjoB2
TLSH
T137650195735018F9DCA3823EC9548906D6B27C6A07B0CA5F13E43A6B5F333911D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 ce4966a80598e36a97539d83970373ed004993d5f695d81dac5d41a4d4b94a1b
MD5 ad9297207e727e0f43bfbd866c72f5ea
SHA1 03ebedabe6d36be93f0c4d09bbf6a7b82490b598
SHA512 f339d193ca44937dce47afe92c1a58903c6ed266e3f0c54bf745867798b1af72760efd67e445d0bae261673a888148b7147beaa484af24fc76bcc5828febc35b
SSDEEP 24576:lcP4mcvIjkGOxhKP2l71nNKbrh/8KB9atr0zAiX90z/F0jsFB3SQkk:qP4m4IpOO67W8KfaB0zj0yjoB2
TLSH
T19165AE2DABDC0096D0BB913485658A4AFAB1742A1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9e50fd6f0d4c7ffb475ce90424ff61278ec519dc33deef120e166b1cf82c5e05
MD5 60837030dcb496ddd53d1472ee8742ef
SHA1 ad6c73c8cd7d2b72f71b6bde89c84aa2865ca420
SHA512 dd656b26cca9793304b6298a3e7e47251f4c326db6ce95501a2f9145b88ad08b70cdf02d8332b7638e98177a3a83e5a8eb7b5d489949f801d3c70a064efe267a
SSDEEP 12288:mNsfVUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8a:vVatr0zAiX90z/F0jsFB3SQkP
TLSH
T19555F00AE25801E5C0AE6239C7544A41B7777C6593E2D3CB62D0FA3E1F396C15DEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3981bd0d21668d9bdbe4470b360f28d5a5dc456efcfb98d5429806084f83027c
MD5 9f1e71fe5bcc619f08115fbcbe8651cf
SHA1 80bc0234c460dea8fbff11545f3cf28872e1ef66
SHA512 9c25cfd817316aecdd906bb8154025bd50ff8476eacc0e46f8b36f5c33ccd7293f4d911585c4d117f65c6ed187e1e277125f49bbb050d643d4f760840faff928
SSDEEP 12288:p1UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8n:p1atr0zAiX90z/F0jsFB3SQkg
TLSH
T12A45230B351E80F3D8E36B301658880A267E7A746BD29A8BF1813F4F9D385C65D756CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 943fdbbe5520f2c9179416da5cf947bc9de2dbd45e4e596e4c7889f0f8528320
MD5 9179ee9b6b29f116ea1da58c8bd82401
SHA1 79f15224266e3ad5b71e1d155a01b01c1e44751f
SHA512 2158f028c7dbcf71bf3bb831487556bc07bbe95f724648220ae8989a9ef70d5b9a5103b3a0d467403b862b82587b65a6b02d8613aa93ebae27c85c9287e42690
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQLaB0zj0yjoB2:Oa0hNYG4JwJB2Yyjl
TLSH
T13585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 15ec3be3059850c248948700050d43406eecac30f285ceba514c1545b4ea597d
MD5 e03025c34b274b82e88759d1609070bd
SHA1 e1b5072e452f5d9c82994c84a6b6b552f29ff14b
SHA512 3516dbc08a71af23431e86cbf101fe6926be057c80ad1729e93dede2fc196aa7c51c17b812d1c1580bdcb9d2b332f967e72823eff355dc72b98263aeb89ff041
SSDEEP 12288:PhbHjfXSUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8v:PhbHjPSatr0zAiX90z/F0jsFB3SQki
TLSH
T1AA55122F266D10E5E4B2A27D8684850BC731BC351762A7DF22C1A27F4F3AAD51D35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 895332e6da335b96d478646c6481a0a4ca0bb03ec6dc7b24e3b980dcfdaecf11
MD5 b6b41e514aa8b15ec7a0046cbaf99379
SHA1 feca8a48fdc3386c170452f06340c9d37222f351
SHA512 eb3d88771c341f8b5117c82af8c7a32a69ede148a9fd0a42445ba598d6757522857d2a1bcb25115eff6b121cd9bc837c4928eea53fbce49678debbe491edf842
SSDEEP 24576:53YgnJcRTk4yti+R5dBR/qatr0zAiX90z/F0jsFB3SQkk:5IgnaTk46pBR/qaB0zj0yjoB2
TLSH
T13245BF2EF2B910F9C8A6D236450147B5BB71782D1F209ACB0170C639AF1AED85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 93b87d38e6098e61d43dbaaff81a55d582add306884719542db9bf81ca573005
MD5 5a7d9df351176e4b84e8ee899eed405c
SHA1 b381daad27f84391c46cd83b9f6cb1c6eb18f245
SHA512 296ff512f5d044334e21d45032abf40be3c99adceee20cb9f97fa21443e55dfbe49c948c485e0dd624209ee93fb9d0799b1fcde6f5ee1910a72fa545183c9cb6
SSDEEP 12288:0JUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Z:0Jatr0zAiX90z/F0jsFB3SQkQ
TLSH
T10F45230B340F80F2C8836B755688884B1A796B7067E36BC7B1927F0F9E386C716756C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 d8b4ce021803be2d17d4edaac98210300a37ba7141d7049367e38d3cb7d2b055
MD5 6363868de03349e70e193b7b9c4fe5db
SHA1 4d05854070fa8211ebf1ed2a2b3495206917424d
SHA512 2b466e8aea2a0810dc6aa8f77ae3d611ac52ceac0ae132141b0cd6d38c9769c72468ca2d508137b30e069382f375dce2f2aa74b5e6db498376e668287e851fb6
SSDEEP 12288:COb9A4LWOsvAYFTwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8c:zpL3UTwatr0zAiX90z/F0jsFB3SQkN
TLSH
T17D750105F69500F5D867923CC9A68917E272B86D03A0E7DF03A85F5A1F237E24E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 11a985911ff41b11074f7ed6fb24ce2dcfc435829e8c99220d51f6c25c0521cc
MD5 f4ca58e947563a317b2e416fd32a27b9
SHA1 5c279c8a3aac3c93f961101d9124843547b2e27c
SHA512 6b32c8b44a713edd19795280159875f3871012b6cd327aa392b197311cc75c79eacb252b04bcfe9c46592f3bf6a482f804320c54a42cd0306e1449a49f07ea4b
SSDEEP 12288:LpFtpOUUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8Q:XOUatr0zAiX90z/F0jsFB3SQkZ
TLSH
T1B555121A369D10F1D473A23C8A81820ED371B871176257DF42D0A66F5F77BE86C3AB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 afc6cd37e2f9a8939ab82be937c84df30717bdbf7a5067543e350947426579b8
MD5 a668c1f7afba430b7e0a15466b70967b
SHA1 a55f8f9bd0caf7115df06b4e7cfc0645f43f7d2d
SHA512 8ff7b289201c57c199104fd4f79ca4af599413d5a8181f8ea0171cb0b986a4590a42e389a99a5e6f369d67cc810063ad10011b461a52169b283090bfda491caf
SSDEEP 24576:w7NM9YqZqmWMUkPjZM48Mv6bEhslatr0zAiX90z/F0jsFB3SQkQ:w7cBWMpPjN8DbEhyaB0zj0yjoB2
TLSH
T1C765AE2E6BAC81E5D477D13DC9A28606F6F2B4611B318ACF1152833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8a82ad3ecdd5a4e2ff3f7fa2ee4fea938ace0845bb53d260d2612faf42980b87
MD5 c9a28906d659109e7541b2e7d5d55461
SHA1 5fa83b0f340c86878d5625b74c7d80604f25028a
SHA512 1e2c08c73ca0f3989aeceeecc1797e623079e2d7ce257b3aaffc3510aa73f7a37eb5171a256e33c2c9321918075c7f280768bfe4d8c004bba4a455ea4821969f
SSDEEP 24576:NW6BApg2YuyuNDYTabvcdvNYf8km1Hatr0zAiX90z/F0jsFB3SQkq:NF2YuHNETovAvNYf8kmFaB0zj0yjoB2
TLSH
T116857E2A27ED80E4E0BBD27D45B6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 4e37e5b952a283ec4913dc5b58f60aa0caba0e04cb06e81b3861ae6da51e6c8a
MD5 bbaf6e9b5aca29878d3597c5bd717872
SHA1 635c6bbcb68ad0dc951cf727dafc871017687065
SHA512 673e8f4cec58d20a2e04a83985580e68e8058c5dd496f3c9a40387c3bb21941d2ed9aef16adc9f1062a8c538d36ddc528e1029f519a35e515ec5fc368c5a784f
SSDEEP 24576:7AFs06+Omlf3NXEbToYatr0zAiX90z/F0jsFB3SQkO:0Fs060lVXuraB0zj0yjoB2
TLSH
T1AB65BF2F66AC00D5D07ED17D8A97C91AF7B1746307215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f5200efae7ccb06d6fccaf1482957bd94b972ab59d1b325db4364f183814dfc6
MD5 21c307409a2e2437ad6b2cfbaf7bee0e
SHA1 57f0ce27da78707072958d51243dce601573053b
SHA512 9c6de9589c2d12d37bde588ef0a291c2d7c203abf58dc61ffc371c5a6cfb71942eb054cd6845327082be858fc191dab38f350e0bd87b23ab32c01d29f60fad11
SSDEEP 24576:SJnJ5D3WXratr0zAiX90z/F0jsFB3SQkS:SJnJ5DGXraB0zj0yjoB2
TLSH
T19575D02DD2A810F4D4B7C27482591B46BF72387D2B226AC724B4E5357F22EE09A79F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1a8be8420f46fc34aae0a0647b8a7619a45c4c82a1d5767aff0754a7ddbb5617
MD5 ee74fde5ef6fe7bb48ea94995fee2700
SHA1 60fa6e106c6a4366c580ac11a5a5ae93e686dcd3
SHA512 4df26f6910a2069fe3f795a0c7ef2bec29430658e68f8679e1e2a07a0f16e7b004de4673c7a57107b04cf576a805b9712a36f06093d4e86b0134530400fcc667
SSDEEP 49152:yg06DIKdwc+eQnSt65aVRaB0zj0yjoB2:raB2Yyjl
TLSH
T18A956C06B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a848e1834ccd8f053e7026cb7e1fc601601c3ca888969e384cd63c69abcf0902
MD5 550ef60202370a8f115bc0396aa5d3be
SHA1 3e4baf23dc533df4fcc12773be002d372905b065
SHA512 0895badc4b80ca7f1b2c51438e05439dd30698591dafb4b75ede22b58c0545a53d50a75c96271c61282b80d34dd9ff2798aef27111921a66f3d7a34e1f5b91fc
SSDEEP 12288:FEP3RnvUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8O:Gnvatr0zAiX90z/F0jsFB3SQkX
TLSH
T1B955125E365D60F6C463A13D85908506D3B2F07027932BEF52D1A63F8F36ADA2D39B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 22f2cdff494fc0cca052c7b2629d0d6417861937b55a08f51c98bc885c8ded5e
MD5 00279574e712763ecfa5014b06e75331
SHA1 d7cfcbd14d94fd26e16862b6849fbd3a7922c2fe
SHA512 60c8893d2ca01aa8aed68c87a1868f12f152f99f66f8c239d973baf9f3ed103001b4a14a4ba34d30087f8f86786445dd4db4a11be10ddc2c092256cbcf8bf97c
SSDEEP 12288:WjkyiUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik80:WIyiatr0zAiX90z/F0jsFB3SQkV
TLSH
T16755120A335890E1D9B306389AA181855B75BC306B6297DFA1C0FF2FAF357C56D34B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 cdca4dd71f53e4bcfd3cce5f0c09e29a557f747e8fc653caa353dcb48146f72e
MD5 0c9c4c8717943497c974821ac2ef9994
SHA1 3657141bf057426c33b59f3db743d4eaf292bd21
SHA512 cf993329e97995a8af84fe280b866afc29de283438ae60ff57e0bd42b47e38448f47fa2a20ef44fabb1e20ae722c3d6d1d506a8100066d97732fc454be35593e
SSDEEP 12288:bykUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8s:Gkatr0zAiX90z/F0jsFB3SQkJ
TLSH
T1A245230F341B50F2CC831B395258894A16757A7027E26AEBB1D1BF2FCF382C62575AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 826ec193f91534b3f3588b302f7c2b2ebeb0b86971bf65a1119528c9e265e4a7
MD5 51d6fa3a1c4d6193b78ad58d56ccfc86
SHA1 e05a5bbdc22dd2bd587745e84010e2cb6cd41cc1
SHA512 71c738f0376ca7c98f1899ba62669eb4455cc176ff975320bd00eed53a2665877ec0901364b1abb98a973f5d34af29ab87ce9bd6bcfa7569fd6af6b4452909ba
SSDEEP 24576:pQ9MxZKdcz9dw3tatr0zAiX90z/F0jsFB3SQkn:pVKZtaB0zj0yjoB2
TLSH
T1E2558D2DABE905DAE173D23995A250C3A673B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 578d3579ed4953c1871d05a28cbe23459245b942de29ad1253d3c81b090e2683
MD5 28470e3ed8ef8fea98c3a1f0e18a8373
SHA1 3a7414e8e1d72afca05c77bf58c0c27a6cee1057
SHA512 06fd77705fe0312df15a635e8d8cc729a0c1957dacd36371e2f93f6c479ff515171aef020f9d84c9c1d9d0fb9517e72a9a40572cb41dc23e2c9b12e4cea36094
SSDEEP 12288:lyoKo2JRple9pGUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8F:lyocDApGatr0zAiX90z/F0jsFB3SQk4
TLSH
T13165E01F7B6E40E2D063923C89848645E773B0705BA257CB6191C73E8F27AE9BD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 31997559d4f40a637402fe97005819a2193284157527681a2939dd1191ccc8c0
MD5 ae073233f39b52158fff7c95c14b3991
SHA1 ce45d940ca73ab59953338e57a6ad31316f52686
SHA512 40b898da7336e85b6eade2126283bc984d7ffaa91bd107f3cfadec2de0015238f879b91e8bcd9eb0ef6146995c3de3a9a2f31a11505c4c6e09c81208a60fd037
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKGaB0zj0yjoB2:W0zuNIPB2Yyjl
TLSH
T139A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1d1e6b65dfcb7b8c4e163c0e7e1dc673c7b5d78a75a768cfdfdb3b0e3f1f1016
MD5 8e0001c8c9155ee4f350804c870a0ba2
SHA1 856b8dda1742bf05127d8661d05a7cb5985d6fa9
SHA512 1df80549e6ace42e748a50eb1dd25e98945d580136e23e55bf99cce20abf840480fbba177d0feed05e015b5dd7795f00bfe31fdc9b9db4211b7cdc3b04b4842d
SSDEEP 24576:m1QT7EcpfxR+N5AWAz3ooiYtjMqbvatr0zAiX90z/F0jsFB3SQkq:rTDxR+N5YzTfjM0aB0zj0yjoB2
TLSH
T11255B02E67F905E9D1BE85799A23C502FB727821033193CB42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 6d69016933ef5965d54ec435466aaba05cdea536f566bf704c11f6e71b52afcf
MD5 4c8d9547d307c936eae609418e5241fc
SHA1 e92dcb0e193a7060bcabffdf507b3a6a11aa2ac6
SHA512 084eb744cee76347dfd7e3614fbbbe8004491e24512a47009a913452555b39ab1a1cd1c2f6f9295833d21c4d5f73e70e8f12c4f81b7a4bd48c2d992aa20f8a55
SSDEEP 24576:aTMdOz0FFS+imSLzatr0zAiX90z/F0jsFB3SQkg:20K+imSLzaB0zj0yjoB2
TLSH
T17A75E13E636D14F5E47BC27D96428906E67234710362AADB06D0D17E2F6BFE43A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 144451a71d9eef56879bb5fe5e8b27380bf59008a29b962e8785dc7911e2f004
MD5 a2ebe701fe67160c933b84ce4e5ab25d
SHA1 2641d33510cf4494cc545d6a5ce59dcf4b3d3f2a
SHA512 a650c351f48f06216ef2e0c1f811382ea03784baa3288e2ae912e423ecf2a6a3cfcca2b588f1a6210a54e086358e1e367677bef5cb0eb411680649cf6a38059a
SSDEEP 12288:c4KwUMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik82:awatr0zAiX90z/F0jsFB3SQkv
TLSH
T1B355120E32ED20E1E8A35635966445468670BC7123A26BFF31D0FE7F8F356C59939B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/412-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/552-242-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1260-99-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1260-94-0x00000000008B0000-0x0000000000917000-memory.dmp

Download

memory/1260-237-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1448-37-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1448-394-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1448-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1448-31-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1456-260-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1696-245-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1824-90-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1824-236-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1824-84-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1936-292-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2268-65-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2268-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2268-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2268-63-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2960-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2960-393-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2960-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2960-19-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3200-293-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3200-395-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/4480-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4480-392-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4776-256-0x0000000000400000-0x0000000000D34000-memory.dmp

Download

memory/4776-10-0x0000000000400000-0x0000000000D34000-memory.dmp

Download

memory/4776-0-0x0000000000ED0000-0x0000000000F37000-memory.dmp

Download

memory/4776-5-0x0000000000ED0000-0x0000000000F37000-memory.dmp

Download

memory/4784-396-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4784-152-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4784-185-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4784-168-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4784-390-0x000000000CD30000-0x000000000CD38000-memory.dmp

Download

memory/4784-301-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4792-116-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4792-246-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4792-110-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/4904-303-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4904-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4904-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4912-254-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4988-255-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5020-401-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-430-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-405-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-406-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-407-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-408-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-409-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-410-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-411-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-412-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-399-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-400-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-413-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-404-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-403-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-402-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-439-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-438-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-437-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-436-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-435-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-434-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-433-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-432-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-431-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-414-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-429-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-428-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-427-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-426-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-425-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-424-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-423-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-422-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-421-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-420-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-419-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-418-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-417-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-416-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5020-415-0x000001D7A6630000-0x000001D7A6640000-memory.dmp

Download

memory/5348-71-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5348-77-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5348-234-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5556-302-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/5592-127-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/5592-252-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5684-66-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5684-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5744-380-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5744-244-0x0000000140000000-0x00000001401D7000-memory.dmp

Download