3e34672c7fa6a7af1ddc7316cb072b41be0f84a05d786f9598b1e010f06ae2d6

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 4.1MB
Sample260813-2y3ehsztb1
SHA256 3e34672c7fa6a7af1ddc7316cb072b41be0f84a05d786f9598b1e010f06ae2d6
MD5 19b22d7558e3048364aa30baf586a3f6
SHA1 798a092427c9e36015b4ad4190eea303f424861f
SHA512 f10abce0ab3e590d3cef411e6b9e312daa6053340376d6121f67c43ecfa151d23381f33dd54c86ffa87eb5f22e336c290d26a8e0873d17984eef1ddc3ca210e1
SSDEEP 98304:zXZYey6sOA1E3r134YpWIZLyGFLOAkGkzdnEVomFHKnP2Aix8EVy:zpqIpWIZLyGFLOyomFHKnP2N
TLSH
T125169D307E6E84B6D4522233C9E8B6B8A32FBCA4273911C792517E1E7531EC14B3E567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3372	alg.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
2744	fxssvc.exe
3008	elevation_service.exe
1536	elevation_service.exe
4600	maintenanceservice.exe
3708	msdtc.exe
3664	OSE.EXE
2844	PerceptionSimulationService.exe
4616	perfhost.exe
968	locator.exe
2324	SensorDataService.exe
1476	snmptrap.exe
4268	spectrum.exe
3360	ssh-agent.exe
2448	TieringEngineService.exe
3824	AgentService.exe
4128	vds.exe
3344	vssvc.exe
1920	wbengine.exe
1300	WmiApSrv.exe
4064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\60e447ba3a3ba122.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8653892772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2f96891772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066146892772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006da6b791772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfcbfc91772bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f661992772bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe
4720	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	2744	fxssvc.exe
Token: SeRestorePrivilege	2448	TieringEngineService.exe
Token: SeManageVolumePrivilege	2448	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3824	AgentService.exe
Token: SeBackupPrivilege	3344	vssvc.exe
Token: SeRestorePrivilege	3344	vssvc.exe
Token: SeAuditPrivilege	3344	vssvc.exe
Token: SeBackupPrivilege	1920	wbengine.exe
Token: SeRestorePrivilege	1920	wbengine.exe
Token: SeSecurityPrivilege	1920	wbengine.exe
Token: 33	4064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4064	SearchIndexer.exe
Token: SeDebugPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4720	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
2372	2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1612	4064	SearchIndexer.exe	114
PID 4064 wrote to memory of 3364	4064	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_19b22d7558e3048364aa30baf586a3f6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:736

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1080

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4600

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3708

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:968

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2324

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1476

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4268

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1612
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b4c8a996cf94f775e676bbdcc9b5c4aa5139f16f616beaf9ab2ad29e4b8b19cb
MD5 5366e5f4a34aa0df874a14ca2fcd752c
SHA1 4891962dd21310a7bfad642326ae2f3cf0b40a48
SHA512 2f42fc746f840c69bc072b18189aeea08bd70ce173032d7770210b2b208438e68ea896d16feff88e3891b21c6e90126d678d3fbcb117be99f284ef6513ad2db4
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnex4x8EVep:E3q6HjBVix8EVy
TLSH
T16BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 d21006a79acbd88231da0fba14ed28ca3062fafd0cae152f97b631b9dc89db81
MD5 22a0598d95a94c5488d177711aa8ea99
SHA1 46a88cf5cfefdbe40198b5cb44142dd98d9f01e2
SHA512 dcdc2542dbaf8ae29ac727a3f0204822960ce8c32a3d595b370056ce74c8620a8e94ba0cd430b0c55a75f7030210d479979b976a2bf65b515a4a0bd83c9f66fd
SSDEEP 12288:P1XLsswWkxy2lRq2czAu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:tXYfDtczAuyxknw4FYnshx8OfVe247
TLSH
T17985F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A5295F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 1aa958d9f9aefc9a95d485d2bf66b260f2d51247eefa01c67ca3b053e724d9a4
MD5 20f4255b2a956b3499aef73578878b8d
SHA1 45f6878786727106206a53fb100e0f3a1a1a4119
SHA512 e0dc9d1e52e4f42933c50715d71e83c5868a3f1ab6c3c6b8b1d5abfe40f214f09dcc53df982a6aacbaac753707555d9a5a73676d72796ab6646f9118aedabc04
SSDEEP 24576:30Le5ji0hmxirMzyxknw4FYnshx8OfVe247:3Pji0Ac3x4x8EVep
TLSH
T1EDA5AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6ddddad523f814069a2444bcf79a13c2c70db67931a5b33d37f38967088c413a
MD5 f76fbaddbc00937b100bd5f91dcc6291
SHA1 dd9380268c87c83860958fa88549106fa3fc8def
SHA512 72eeef528419c19d25b70fa832547ac977f3edf088438363a601c6be358df9100ed1c7497b1e8d19443b39154713c6406010861a3697280b70bab8b5d48ead14
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyuFyxknw4FYnshx8OfVe247:Q/ezSC6vUzPvxHjyTx4x8EVep
TLSH
T10B756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c145ba2a530428592261596286eee731557f641fea95984b4b9b95e8e98f3d7f
MD5 9b2270cd153e13f7520013ad3bf3a8e2
SHA1 98eab5891153067d42218ee77dd1afcedbbcfbf0
SHA512 a9c6c14cd45b46aa8a2024db8f35367ac1ba3c9061dbc84640e67ac8b4538cfafb5639a996f258d93beec1cc23112446bd71628031b218d561a9270d2bc3cf62
SSDEEP 24576:uVbqPb88hv/l+6qyxknw4FYnshx8OfVe247:uVO88hXl+ix4x8EVep
TLSH
T138559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 fc333cf0e585d63b8db15dc445f90cce3822b7e1e1e26298bc7f6cf3d67dc977
MD5 e307406ab5270f21b380c42e1a9c02d6
SHA1 9ede92a4e5ed7efd80bd57438682cf5be2308201
SHA512 8133b88f990b1423a1e32b9b8b9b1bc587378b9b84bd0dc9ade6548e8f3a90c87d0f5eca4dd518ec488464270aad78e302fefc8dbe620002f3b8949b1dd2854d
SSDEEP 12288:xR/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xR/yxknw4FYnshx8OfVe247
TLSH
T19B75237CA7DDA4E1FA5E14331B7572623616BDA4DA74C11BCB78B14EE0B0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 57ed1fa43d7ae98e89e81b5841b9243b9aebce6a8a38a012e4012204bb9d25ae
MD5 7abbe37650d07aad1122e3a346118d90
SHA1 b40f7a7318c81109bd2b757f9b1e7f04e483429a
SHA512 50fc549632316477f101b36e4eeb2e0b74eed0602febe922b9e0ad822f92e1507834bc696bee7bbb93958e43aa427608854f13196d213c5eb27c44cf408c88fa
SSDEEP 12288:xeBNUbTVO86Ui+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xJIUiyxknw4FYnshx8OfVe247
TLSH
T19A85CF7BEE28FCD2C27E4DB95B918600A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8c5bc8ccfd2e8a7fcfdebf107dc72bfe7580ccd889d4a33497b958790623b9e
MD5 310ceaa5100444cb0a9b225a9124ca98
SHA1 9ff66228b9ba7ed2157f328566373bc8ea7b4ddd
SHA512 d2ac781b62f074ea01161bb741a07f856fbf20220fa534ae63babf40d20766e386fca8a10301d196e6ca103b05870ae1e31f147575c05f1c65fbbe90b061dc93
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:0QvGAdlCEL8c/yRNw5CAix8EVy
TLSH
T10D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 4fe9728e3850c12c15838ec3d2511d70b17767fe6d906d10c80c2352c5d6d7e1
MD5 36956f3ec0be71cfd323ef8f066cc315
SHA1 94c47d2f3f809d8d5b1f457b4afb819257b9ba09
SHA512 05fc733684b8a4e0a57f8eb4cbf6d14502e34c8ef7632e8c4b9c024ede3ee8ea1977aed74bc5e7c0abc34912fe1a2ec387fdf3898883801690b6e1dd615e00c8
SSDEEP 12288:FAwSfxL/2Dc34DLLmt0LDQewsAjM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:mdewsAjMyxknw4FYnshx8OfVe247
TLSH
T11095E030FE74E032C6BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 27ba6b38cb9f3cd3783bbab49332544bb9e38e1fa13ffc02ba73c9ff16bfa6e4
MD5 dcd4a00199c78791d1066f66d0612730
SHA1 70e8e80a26499d129edbdee0ff4f6826a21be234
SHA512 dca396f705072e3963d1f2dd752dd37d258c2d7ab94d2c4adba2061e3ab30d9041ff4f2a9bab40b8f17c77420e821c8f4742a2a78bf41f2e36f02aafecb4e983
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHq:OUEtQevvqc2W1cpV2EI32
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 976859c2abbaea64f88e84a83a477bbb439ee3ca9719f12832fd04d899803f2a
MD5 3024127f2b86cde0c419744f5ba01889
SHA1 0da506681dd5f3f23b004f92f2dac280d27025b6
SHA512 eb0e6a2949f53b34eae14a516e888bef2b387970ffe183ac0a3f8d654c77faede90bd9e57eb692dcc949b8391d5ffe1430d9c8005b3086241151ccbe5fe8fe42
SSDEEP 49152:xCbRquA/m2yL5zQfFiV+XenmE3/zHx4x8EVep:+oqtVjnmsix8EVy
TLSH
T114D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6107e2618d4faf0ebb72333abf1f4e5ddc06e90bf2e94b778d6a45f3daa7b095
MD5 8d60af73a917fc5069186d9d22e1c3aa
SHA1 974b34a406006816c4c57b1c2dd9d9b65266d4dc
SHA512 01a7b787cefcc3ee097935d34ab23ce4d9bc5cc85f394138a8e4a23e41866685cc6d79c8df5b37c691f7aa341dd3425754ab7cbc34bcb32054db1ff8e4b5bb4c
SSDEEP 24576:3AhGLJIFoiwtA5l7S53Jyxknw4FYnshx8OfVe247:3AMyFoiq5cx4x8EVep
TLSH
T16E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5110c7fcc57fc0417533f114c46642b69865ce27cb159d2608c0be6c4637d15a
MD5 9718d64d206f3a46abc8a0aa7be24490
SHA1 3e868b0a0af8dd9a1f5b6ddab6c9601c51c31a3a
SHA512 41f043f0a66ed91a0a01cbb3c80e066e536b43428536a191e6b7fc70b07f196723f42b4ec0c8c7f98f895101ce4738907b3b33a30c68674b9d57117ed62823cd
SSDEEP 12288:Amw5HEjsChNVBFgl0WDm+Cl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:dwuoOWwyxknw4FYnshx8OfVe247
TLSH
T19E85F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 abf8494848e5f4de890790f4c3f3f9cc6b692c86222432acad218362723fde62
MD5 39bb0bf179f2786392eee4046c357d45
SHA1 918f55e41afdff3a9ae99476f4ba825d7c9091e5
SHA512 31f48f309a17468a0c153dcae38a2526ce7b89d73afc156c48300a3d2bd93ea5fef083298034fbc0012f84d325948925e8f29490778f2524cf64f9e1974256e4
SSDEEP 12288:yBZ1Iy8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cZuryxknw4FYnshx8OfVe247
TLSH
T1FD7512AC33E860F1E197113A89F15205E77274A2677183CF4664A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 14ed7ee3d2e28d384ed8f7e91bdb7add06f3a8cc9d6d56a8f72f8ddbe1d730e9
MD5 98344bf4fb54b7629e220787494bbca7
SHA1 3e4a048672669a700db93e07c0f90faed3491f2c
SHA512 0e0bb09eaf13378233625dafafcc85522ca2056059b6592745b05dc9fb3bc7770f24e371f4fb36cbefd8b48ee16d7a1ee54a05d9a09836e84fef387973f5c957
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:rQRQyi36YOcPQLvw2gAf+PN3Zix8EVy
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 533534e4b87bb3bf764e9f0663edcea604567b24196f23c10d2ab4b749012215
MD5 a32fe6809b64de57e8e821fece12ec48
SHA1 e831801d1602514e30a685ac8af826e7536aacb8
SHA512 e5645b28656607455a690e74d6a49e67626a8cc653c929cb27cb9c941d969ca48cc7425a531b5270bc4f83d99bc72068a2166c8cfa4b7a3cc2b2d5988f1cdc26
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:7QRQyi36YOcPQLvw2gAf+PN3Zix8EVy
TLSH
T193667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e2a5f2a1a9288e8176abae3df15f0f8c9a3ec6e06f85e527740ab3f45a8209cc
MD5 012b66d3da5bd4160222bb6bf8f9649b
SHA1 c49fd2ddb896f1a211351bc214232cf739b0f6fc
SHA512 17dcb7e2065cc65fbf289981111c0f211b55c4db8c9fef7240291c7db6d7def8895aecdca6be578e0ae2a00579a958b9c534c8cdd5a6d6a8916ad2c4e27ea975
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07yxknw4FYnshx8Z:J68Qg55nhheWu7PNU3/3x4x8EVep
TLSH
T162B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5a19984130c8329a6512662bbc95eac95eba8599f1637f52aa2970a410361e79
MD5 db706996ba8a775237aa5a6ea91809f5
SHA1 524bd760c5af9e1a64e2d2edd90ac1fd34753d75
SHA512 9b592a25fe9dced551bbd7ae43bb5df77a32f7cadb5d098a1a7bf28707c99afc0ef0d156f494a333230ac5ff1a93c7a4802e7080a79cbd93d139f66419ec4c04
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99P:vy5112gYy5azzVvL69nLKnhZqix8EVy
TLSH
T15B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 53397891ba46f766ed3b6134b810b440fe732009ba82d876d4547e4aabccad15
MD5 6187a7593f205faff1a46535b106bbc2
SHA1 b2374f06c762f7e8dc2ee86838f767ea7b779b68
SHA512 2ffbff7a757c5291fff77a74ab30baccf150c57bf2ee4cf4c08e336f21f767054eec05e4193f0160754bd70ea9b3d15fef58409ec0a6a90f150187ee3494c4de
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxx4x8EVep:3u6JmVxd2dxix8EVy
TLSH
T121D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bf632eb1481c037d598f5fa4a20dea1781a2bec9bb5c4966b183d17110810ef4
MD5 b1e852b719f8f175af247994a3b9d62b
SHA1 8f72894cc8319cf593cbdddef90dff5f95e879ab
SHA512 df003ff5f248956ab258682f1ea88ee10f8721e410c04564684b3a6ca8814f924bcf92ba61e226a5b2d592ab0190b4e22aaf4dcf6b6bf03cfae68a8d3b8292b1
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4x9x4x8EVep:+mifPbRsix8EVy
TLSH
T150B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0d8459b41d0170ed9fe32435c9beaa925555de03ed69e2ecc2d2c17fffd4bfcd
MD5 e67065f9c42d3d1dbbfe7873ba77d84f
SHA1 bdc595a8a04265299feb85b1f634d2500f3c1e44
SHA512 2ca621cedb831735e5647d84227d3a9dda41de77e5610cac20c1d3c993f9f503cebf2314fbad37890e8725ceca2d15c6a43a5a9c47be47aa15e804398ce0fcb8
SSDEEP 49152:kSuZQIY0Be2KRRVtOnks6NMHqOx4x8EVep:25dKTi61Oix8EVy
TLSH
T194C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 47033bdc2ea9de925b1340c44f6ed4d114e03c007f75a8d6b58fbdcff1264f86
MD5 73b77b653ad6480c979e84d837447465
SHA1 3d8bd848deef34e0ae8ef0af750e1f6e9eb128f9
SHA512 57a722c9dcbaae9ae3934350fa9809d27e8484f5d40d2f344a0514bcae5cc2e6d82cc790dcf6cad0bbd5305541d7a06279a12476dbb05a7c745330a88760f723
SSDEEP 49152:ehtSn8EApI0figngiDn0AP5whx4x8EVep:/X2iyphoix8EVy
TLSH
T14795BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 2f469f25d137b68c18608b3064b612f2449caba8c3a5388ad9812f7d70c97702
MD5 f318be966f35c9f4778d48d3b1e132e0
SHA1 4cada688e39dcb4b9600bd9fa8910e06fd3d2de0
SHA512 e3419edaaf399cecbe43a8facde935e0a257d4d1854ed5e02ea401e2a5cba00ae974d6268c3a8416dd514ec89aa11c7b80b6406fb12f1482b402c30f800104a4
SSDEEP 12288:zX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zXyxknw4FYnshx8OfVe247
TLSH
T16475237CBBDEA5E2F50D11734B7162627609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 314ff23001f5c6cbe42801d3ae2b447f23e8d933401b34f29f521e027a78c8a2
MD5 79fa3f67301e306ce232f51d2f4dec4c
SHA1 33753ce3f48df7f98144e7d4896a5edd262ef88f
SHA512 3bc1424276f8745d10749d53d7e0f59613fc0efdd7c6b75b1513f758dcf9018221723c7a53e07b9508282ab5b99ebb0409447e41cd2469ca217f3fe3135ec088
SSDEEP 12288:SY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SYyxknw4FYnshx8OfVe247
TLSH
T14675237CBBDE95E2F50D11734B7162626609B5A6EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 21e864da55277fdf14a63e3e096accba8748be099f063e89114788f40b3a3405
MD5 d75afa248b816e2224a55113469f665a
SHA1 13a0671ddfdaf010d31704ca1ccef7757487e6da
SHA512 98239abcb6832bcc205ab7eaf086df0ecd165fb1083b35c98324d5854566284cc63f26c40c9389473387cd0a4cffb1ffb472cdbcb96852db42821bc1277b2cf7
SSDEEP 12288:16+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:16yxknw4FYnshx8OfVe247
TLSH
T1FF75237CBBDF95D2E54D10734B7263627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 73b6ea35d8ea8cc10c3146a533222849fbcd377ac683f0c8b3646b0de0d26915
MD5 b80830e6d33deef2617e414b94fa6db5
SHA1 ee2dfee17e680996361a746cf7b8ccf902e0eec2
SHA512 7ebfb2ea26735292c90ceb52bcb7f13109658b2569194524b0eda3338a7cd3572ee99757b33898ff6630181ead9d4b52ff0a88f8aeef3d599520ee9630d42cc5
SSDEEP 12288:UVp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gyxknw4FYnshx8OfVe247
TLSH
T11375236C77EE50D1E85A51738A726222B365B8E5E731C35FCB64700EE9F0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 1ecebcf2d185f2651aaed4a7738398ef74937bc542b956f1ae7643ae1d71fa23
MD5 d6493095786c509634376ec9300877b0
SHA1 c1297ddc01006ad8bdecaa3545edfd1922561d48
SHA512 a7ebfef830aabdcb95c97432efe3529b97ff8c160f7244d4ad06e5f6c3cfe0934d1a45f970d27a43d7730774c62dd04d8f26ef375f1cd9a4571d17dd0f7ec2e9
SSDEEP 12288:fx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fxyxknw4FYnshx8OfVe247
TLSH
T15075237CBBDF95D2E50D11734B7263627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 38398a41bec82402ea9dc44c063bfada3cbd375da94b0821cacd951cf8772897
MD5 2105d6c91a5aebed2d71609da5ad5be4
SHA1 efae4d26f6aa01e8c882bf6250b7499fe58d028d
SHA512 cee86a49e1ac1639b34f9e495160726fbdcb18d829603faffe7338e8378bccb8d34fb7c894101a36913eb7d49414e0f900233d962e27de78dc420ad5bdbd6dc1
SSDEEP 12288:uE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uEyxknw4FYnshx8OfVe247
TLSH
T11675237CBBDE95E2F50D11734B7162627609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 bbbaff833e9a122dd9a793bd8d033ceb7fd7fe06043cda5f234fb45023aea569
MD5 79748fe2b076cf1b5635a109b5eb8710
SHA1 61ee076b6c9c4257eb216f43bf567d5eb76a33fa
SHA512 8caea80e0dbbeb3e5415213518de20705d20ebf8c990456377c94f3b18967a0b16ced66d800c1e47c11d4771f563d170b0873db4f34492c7879250b8caf94e0f
SSDEEP 12288:oA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oAyxknw4FYnshx8OfVe247
TLSH
T1AA75237CBBDE95D2F50D10734B7162626609B5A6EAB5811BCB7DF00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 d85b0afbfc7c68dd5d04bff2c51f7cf92447ca5eabab85dcc9170530898f48f5
MD5 371bb75fa75eb2f2a38df7f47b421f3d
SHA1 c2b1e931fdc05ba4e0da429e643952fcfecef822
SHA512 76d665d6d0a9cd34dab50f5cc080d7c136f5e0087ee68999c69aaed11ca5293ca2198ef9b0d47e3d04ec3dcf1f702d0c8fc7a70752bd2fb5e979a19bc7fdf67c
SSDEEP 12288:BiZwb6zzFEoS2cPvy4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EZMSzFVSO4yxknw4FYnshx8OfVe247
TLSH
T1578501A8B39018F4EC67413FC9259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 ab8c2456f7e38d73defcf8ece36506eae64e2ae000df00e2cef30004b1906ecb
MD5 a9e3f8c0d15e3bc38bd5e6d53806cf09
SHA1 169ee0f9b922e7e346e5aefcf5dcb272892e2cae
SHA512 719b3005d36c36b42bf3c581719724fc03ab8328ea5efe075a8aa5c1f5a3a478d20b346055c14aa7e3ac93253da4b2ffa37dba15d97aa498f5306865b3173455
SSDEEP 12288:0b+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0byxknw4FYnshx8OfVe247
TLSH
T1CE75237CBBDEA5D2F54D10734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 0a90d05fee2f1f8e21073694e481c702f7d2366c5953b9a8836d103a3fc8c7f2
MD5 2951a4efd591076628070a3a9c6f041e
SHA1 2aeb26b0db18728862e7fae36e409a6527170c84
SHA512 750bef3a4218bf5da9b17c86f70578b8799acc95a20de49a44c9953b7ca3f06bd705c06cda727e0111bf4c94e26de718e186a127dc49a60d996f43b0cbbbdbf3
SSDEEP 12288:qv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qvyxknw4FYnshx8OfVe247
TLSH
T14C75237CBBDE95E2F50D11734B7163626609B5A6EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a9ee34b718dcdf638bd244ea5c28af7e7749b4cd3376fe27e02769c902ca723d
MD5 8b4752ed1e101c3047b587b2361cea2e
SHA1 7b27c90bce4b16be08e73cbed97872fb503e0903
SHA512 7ac1bef72c257d81038cfdc64f29eada90a483fdef4a59f8932d05d453faa8393e942e1e25e78b863f070c201cc0dc169ffea1e978daf9f947c16cee0f7919f3
SSDEEP 12288:KyPz5L88+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xzy8yxknw4FYnshx8OfVe247
TLSH
T1A985125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 4e24acbba6bafe3b3296c5ea944c2987f8441483659152f6fb0554c313d73d6f
MD5 d8cbb30689a8e83807fec45c5d77e43e
SHA1 fc2e15775c2811f6cc23ef85e68cb8069447f067
SHA512 7e45fa10588411554456bbfefa4f5da30e1e568b5c4db8f7198cb20d0259b893eed942caa705b9add826893b1076a645f5f4a480057d6e47c29299d4be2b91ec
SSDEEP 12288:yb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ybyxknw4FYnshx8OfVe247
TLSH
T15375237CBBDEA5D2F54D10734B7163626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 f2fae72eaffe87fd206691f1af1747c92c527c0fc94e981a115c2b2b53aa1c25
MD5 9fd986d43246e7a77836b4ffe7dd71b0
SHA1 ef60a4aa4ed1cab8717b94e41cd52e74c0c0abf9
SHA512 763772b4c42417b6c9e7afa3d8a8aa1dd972a42fdf87af99d2681f05e3a6d0b2cb811f2d5abb0a73d3cc82defa4c192e8bf8520e142ae515e1e7ee60e82f5a29
SSDEEP 12288:Wb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wbyxknw4FYnshx8OfVe247
TLSH
T13775237CBBDE95D2F54D10734B7163626609B5E6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5575c0063615acae40468fdad07713784937b3bb41584dbfc52481a2c920213e
MD5 f969f57d6637094b5f70cb80bb44836e
SHA1 d032b760576d113e4a2d5685defedc9aa91b29cd
SHA512 13bbea7f2fc1d7108592449aeff48c7b774131dd39b3fa83c0599e23a86e1a6398457854d2ede1a8e3d68bad83cacdb50b1c413729b8aea2022532a6a073da9e
SSDEEP 12288:dyPz5L88+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Uzy8yxknw4FYnshx8OfVe247
TLSH
T1BF85125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 33b4eaa4dbe9ca82dfa04310dd08c4b41165a872f32912b38c53cb5f2ff6cc67
MD5 6776a340546c047ab85f16acb8b60b8f
SHA1 4674e196aba77035da1272689f949cf668c1b00d
SHA512 a29b65bdb43aa13860f5bbee3c72b83f6ebec6e088b6b866a9d28a25c0af3644ad6733b0d9fdf69292f2297904565aab68818199261c85a8ac7c67418823a51a
SSDEEP 24576:QcP4mcvIjkGOxhKP2l71nNKbrh/8KBDyxknw4FYnshx8OfVe247:7P4m4IpOO67W8KAx4x8EVep
TLSH
T10F65BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a314df01b2f4a2d99f1b05d712f2592b586542e1bd90e7b89850b389af015d6a
MD5 12e6b4911d30d128e8eee7005cec9b49
SHA1 ffbab33a9e5680b97ceafa0c45e61968b3232eb8
SHA512 01e4323cdd8b367035636a89fa0cbf57305fecefa2b9c1d6eea003eb8d06176e0183376735ee7b5f9caf261efd6768b89bec9e9ed7d63e6f3901b1393388e606
SSDEEP 12288:mNsfr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vryxknw4FYnshx8OfVe247
TLSH
T1D675F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TWAIN.LOG

Path C:\Users\Admin\AppData\Local\Temp\TWAIN.LOG
Size 417B
SHA256 c6e87110dbc22d6a43ba6b92d0bf6ac32f362286c48c7281d9cd0def66d6379b
MD5 87bf8a5bb922099bf29642b6c3a4704d
SHA1 8fcd2ec7082c5c53df4ba96e9cfd1b6b4d3d44a2
SHA512 1178ba77ca3a6174eee544b413503247e47f0b6ab449d6b3b7ebd4e68f9acd8df75bab44ba545b6712706133df4b16b3db8bee13ec5a02cb0de0a975eadacd8b
TLSH
T127E0ECA7E41C207FF03BC41CD30E47B390518773D1424134F641767A752E15957268C3
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 be551a06c0acce756be61909fa01bf38e95a828ec6aab0a4b0f6c80258d74165
MD5 4f015414035e274cbeb06c85c72e0f10
SHA1 1be32ef7102d5b6274b14a045ab6c273a94f20be
SHA512 2f05fa6e0f85067c743ae05945d01a0a3f282e7b4197074b494cf1a05fbdd69e14743dd80696a0e94803a68409a4323d5b5df1add7e2bb2736db8e864615e731
SSDEEP 12288:ZL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZLyxknw4FYnshx8OfVe247
TLSH
T14075237CA7DDA9D2F56D15730A31A231361AB5B4DF70C14BDB68B11EE0B0CA0E82E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 4218162e886ea26071152822012ff6f4defc15db5ce55df0815f514ae08840d2
MD5 71e684bd607315cba06c4711534c73f6
SHA1 1871ce96383478984f7803b6827b13a37711a623
SHA512 4d12fb50bdb651e0191d50cfec2de580f6fed717db6d43db646b94bb1d9d679ac8dc1d586b0c6fbb356313be07e667210aa368658a4bb0a5b62248b8f8591b8f
SSDEEP 49152:ua0h2GEkuAe73q3pp46zwwQ0x4x8EVep:ua0hNYG4Jwvix8EVy
TLSH
T15985AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.6MB
SHA256 fb934c2efd9fcd9b5087cc4b47c1fe0cfa14be52b2c7a98b5e5da72b50447962
MD5 f66070a9176a79b5e62f6cab6626ec93
SHA1 c9312b1f453eab355e6f5d025795eca6670f205b
SHA512 c766471820deaee25a8b888328c90e5b0d37169c1a6751a216e80270e56b9dca8a26327cf905ce36387facf65351c2354d707593cba3dadb580159660d9d56db
SSDEEP 12288:ChbHjfXo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ChbHjPoyxknw4FYnshx8OfVe247
TLSH
T10075117C27EC20D1F175A17A86628206E331B8651B3193EF93A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 f891afb180a39329f7c8d767b86f00ead583632a8d1abc0f1445937803b328ed
MD5 8568f4973243a3a01a6ea7bdc6420e47
SHA1 dcc9008b6176f42e373014896121b5e4cf2154f4
SHA512 4ad73b7853beb6034f3fc2ab6fe42132448e454ee4f9544a063ac14663e9dd05feec22304d49986eda88e317e46f1ce75bee92dc8a1a17c5709c3a593030360f
SSDEEP 24576:g3YgnJcRTk4yti+R5dBR/wyxknw4FYnshx8OfVe247:gIgnaTk46pBR/zx4x8EVep
TLSH
T12B45BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.5MB
SHA256 726c4394e1f47dcb59614dcdf0cfa216c2e34ac61162969ed76b4fc3ce90bd6f
MD5 748b6af7b55ea33098e1f6e3a693db8c
SHA1 37ab2aed4cd0f681f75c694eeda3bb471837fab6
SHA512 35c15b7bf8bab4647dbe7623b18242edb046c2b5b5324edae2f1de04f1bd81435b6381fcf8e9e43fdc4c0ac56a7b20f1d52c9775b7712d98a93bb85c7d075ff8
SSDEEP 12288:Uf+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ufyxknw4FYnshx8OfVe247
TLSH
T15275237C67DEA5D2E55D15730A7262223605B2A0AB7182DBCB7DB11EF1F0CE0A03E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ea4f34f1d361d8cd9e5d5369875e7ba0624f0bebdefd71d95c4c8aa12cc2311d
MD5 95a978eea298161713dd44461887544b
SHA1 2b43bdf0c3f769179d12fea218352ffa6776c132
SHA512 48512dd874612315c7b1d317478bc23cd387e414e599b8121e16d9ab8f29e18113e0d9b67eb9547cf06a095634129bbf0e10711b68b8307a78b8bebc763ae697
SSDEEP 12288:7Ob9A4LWOsvAYFTu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EpL3UTuyxknw4FYnshx8OfVe247
TLSH
T19A950158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 85fa20db23e1c77669667b471932452121a10348b51bd8d65af3d59a14d12a38
MD5 ed682f04fec19a67e96e2323ff28c6c8
SHA1 da3d2ff2569eff22c7cd9a7628c31b6b899ed1ba
SHA512 3487c5b86d2db615373ebf7c24969bc1ed34d787306fa17d55b5655eca28d9fdf365baa1044c35e29dc52cc51861252f503077b02d7f1a4611436e9e2b21c696
SSDEEP 12288:RpFtpOC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hOCyxknw4FYnshx8OfVe247
TLSH
T10C75022C37ED10E1E179613A8AA25309D371B465473253DF43A0916E9FB3DF8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 31470da661bafa64d9b815b8c6f913e3170db4a72a478f6e50a7bdf548d96f0c
MD5 936cdae5bddf2d5d581057fbb0a96474
SHA1 30b13a7f0a9d88105c8d21da7423f76d019b3729
SHA512 cc986eafaea43ebb4d25aa45fad618cf772bf466e36823c321bdc7e831853331836f68a12abb851f17e514ca7b75f14ee50dbe9e6c9e88dc0c8db2be090469f3
SSDEEP 24576:07NM9YqZqmWMUkPjZM48Mv6bEhsbyxknw4FYnshx8OfVe247:07cBWMpPjN8DbEhrx4x8EVep
TLSH
T104659E2D6BEC81E5D476D13DC9A28205F6B2B4611B318ACF5162833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a0dc12906a818bacc7ab072b1217474d3c74a364412113f4ee8bb4c05aefc77c
MD5 ddbdb462c82b39b1260aaf5b01adce11
SHA1 0c5fb6c32dc7e2cfa02dc8e246cd2289ba12928a
SHA512 4bab1743e226a868d9591d845e7b00db8a60aadcc42683b7bbbb441922b5ef70ddbc92e91aad1b5ad0f1a5768f57022841044ebe4e751a9a48b88ed26f5a2845
SSDEEP 24576:cW6BApg2YuyuNDYTabvcdvNYf8km1Nyxknw4FYnshx8OfVe247:cF2YuHNETovAvNYf8kmex4x8EVep
TLSH
T14A858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 df4810dfb578f3dbe4410dc6101acc79ae3676a1bb2cdf1b0b3463d1863b2b17
MD5 d0a76c971a83942fc517fcc135f02320
SHA1 70c8d77cbe531f0d52e7a49d11ccea73a92ebde8
SHA512 46271d3d932760a772246ed26075cf4921c744fa71dfb6db8b09e21d6e0746839781ec4367006471ee89bf7d33254ad481191a0cca122bd827ad96217cbdf30b
SSDEEP 24576:IAFs06+Omlf3NXEbToGyxknw4FYnshx8OfVe247:NFs060lVXuUx4x8EVep
TLSH
T18565AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.8MB
SHA256 e477d83e789508c1be57c2554876d308f0972ae07b9d9f5934356a649df3041d
MD5 cf150542147e0766bf18d977f1555882
SHA1 e873cd67dd01995dbf62f3123b110c00e1059102
SHA512 ff8fdccb9c23dede47bf58dd236f85e2b9d0a57ad5e1c956961677a3d152f09201154f4398a9a03062ac222c2936e74594276fe120149e5935f9c52654e87d5b
SSDEEP 12288:dCJnJ5D3VkrDzx7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0JnJ5D3WXRyxknw4FYnshx8OfVe247
TLSH
T11D95E03CD2A810E4D4B7C274825A2756FE72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b313b4f26210f11605a7f6e2622768e8905f60eef6d2d01866b40264480d5e5a
MD5 4723b642d97990e9bc6eea1e800cab39
SHA1 371d1dec49eb2b674fd5b23acd4984eaecd398fd
SHA512 c960b06ed8cbf1049c9adcf4bdaab29fc7229859be0a909c208dc093f88878165dd7794938da09e0a0d6b4c74f26b59cd7ec411e397e70a47b290403d5c5ae8a
SSDEEP 24576:sEPghm6/7IIXdwcXrif7qQncjlP65i3Vuwyxknw4FYnshx8OfVe247:zg06DIKdwc+eQnSt65aVix4x8EVep
TLSH
T192955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.6MB
SHA256 14ca78ce3fb800669dbfa06df7e56d72892cce04261ad68cead28cf674495bf6
MD5 80c151c3c3e7f62dbb1e6072196b0f9d
SHA1 4e536527baced176b22af6f9c1c8ccaa2c76695f
SHA512 5e07801184187a2527afb0da966438ca5893ce74459fa049ca32cef22aa22bcd3735251a2041d4b5aad92cb8707485d6a2c04845368639a36e3b628d31a00be2
SSDEEP 12288:JEP3Rnl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:anlyxknw4FYnshx8OfVe247
TLSH
T1C675126C77DD70E5E12A503A86A18205E372F0706B7253EF86A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 8bc6bd3b34b192a3ea18d30b0ee979ba84a5ba3a1fef2d9621e6a023bc724cce
MD5 854e65e07ad71e2d9372707a5b28beb9
SHA1 9d538de4fc0da4a2041c3d4e57c0f7e49d78dbd9
SHA512 50e431b38edbdfdb5ee7a634f155f1fff6c13f0a8b393858b5d722223b4a7fed3732b2c38b8df62404b9ecfd7b9cca7d7dc69f8f9ba1a7282d977564d65a60f2
SSDEEP 12288:ZjkyY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZIyYyxknw4FYnshx8OfVe247
TLSH
T13385121C63D8A0D1E5B905369A7352A15A35BC709F3193DFD290F23EAE71ED0A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.5MB
SHA256 936a99f09dbd5d1a763da96ef2c9853800b1dd6212b705b53a47a4a26fa764ab
MD5 9193bf3c56f14afb7560d35b9562359e
SHA1 315a15fc49be6789f32d4c151b5e69104b83c694
SHA512 b298125de366894c755be886b25bde74fef2bbfb55e2ec5df8d9a14d0017c890464e5d02816c522d913bdea94a3107012a9839e02df106eedf972306d67d5181
SSDEEP 12288:3yy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Cyyxknw4FYnshx8OfVe247
TLSH
T1E875237C67EAB4D1E9191173063163626225B1B4AB7191EFC6F8F13EE6B0CD0A03E953
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d0116e11965bacf9a83094dcd23c1ef78f6eedf3a51fa970d59f33859a5bc5b
MD5 9a42cbddaca352bb13c1a0a98514a280
SHA1 c6b4178d74c4f8cffb62a2339557d1f233c47d92
SHA512 9153adbe29095cf04f4acb801e429890315bf820bd586644a5ca5b0a37c2f15ab126a31dbb6ab1b78c48a07b0384abc80dafd71b89554b1d0d889f3532b1ae9c
SSDEEP 24576:TQ9MxZKdcz9dw3Tyxknw4FYnshx8OfVe247:TVKZWx4x8EVep
TLSH
T19B558C2DABE905DAE177D23595B250C3A633B4311B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.7MB
SHA256 34d74fdc93fa099c1f2fb1f337436c483dfce8e8f922c3752b22257d89269e8f
MD5 644a0c5a312430518cb39809c4c68c55
SHA1 e502c25bf5f01ba47549eddd948a50a7619cb032
SHA512 f07c61edee97c1d0a7119444372bf414e789e624cbf3c5eeb0746d9ebc132a4cbd5c918e26318756b1167686eea4e5dbedcd62cedb847f98f09becaa92fdedbc
SSDEEP 12288:nyoKo2JRple9pM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nyocDApMyxknw4FYnshx8OfVe247
TLSH
T1E785E01FB7AE40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 27562e93af83557eb7fc7acf03c847aec8ea5015499865e3f06c10507ca4e4c6
MD5 1072bcc36f6c0a5537d1d25cc3222516
SHA1 35b3a4c4d048db78267e38b16bfe623c8bba4fbe
SHA512 ff2a147a0de706be61c730fb661ee9d154c240a37e78355200e867c0686d24f85729335434714b2b81f7c5b30a527083198b3f5de2b0ee68f3a59793458f785a
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKnx4x8EVep:y0zuNIhix8EVy
TLSH
T15CA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dafe1b32e38de7eadb141027065259de01e66d445931ac06522523ff41a7d4c6
MD5 313593c0d30b13958a4e0fa0a14af29a
SHA1 4fa464c25c20ef7a89fe99dac736dc07fcce46dc
SHA512 194c2d929c8369bea52dda04920bed6bdb98e234ca20aaa3930e363d5ece328d73a947c5cf54232d751ad8699a403c759b5666326df56751a59b851627e12cea
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYtjMqblyxknw4FYnshx8OfVe247:RTDxR+N5YzTfjMdx4x8EVep
TLSH
T1A455B02EA7F815E9D1BE85798B23C512FA727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.8MB
SHA256 2cb4d08205d6e0bea7fd1f9a85156b86452013d7633d69c6d8749e0444162572
MD5 8eedd461b7b132cbd74506cc4dada64c
SHA1 c2999a27d6df39ddec2fb143d11c7474e9927358
SHA512 f87ad03f79c1522dab7a595b6fb5c5710d381b87017ce6aeb414ba7e67d2d8660ff032e6e3b7a2e7368d34fd94b256d4d58181f7f3ba55bbd0c863191dd2e6d5
SSDEEP 24576:sTMdOz0FFS+imSLpyxknw4FYnshx8OfVe247:k0K+imSLsx4x8EVep
TLSH
T1C695F13DA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.6MB
SHA256 e231e9b8c4e901a6bc08c23868b0e37c9aed8a938f78b276683006bed5478e9e
MD5 efd3e63f2dff900527845051d2060eb9
SHA1 31fff4507a94ee9e1764aa79f384f895556c21a8
SHA512 db95341167453a81111f748a294d96e56fe4e7004cc752dcf38cfe80ae7052eb9d108e92f57b7c27edbbfad85eff0b64f6f1ab4d968e9b6b86aae3b04983fdec
SSDEEP 12288:m4Ku+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Uuyxknw4FYnshx8OfVe247
TLSH
T1F675122C63EC30D0F46A52368A325216A631B875673192FF6AE4E17E9F718E4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-276-0x0000000140000000-0x0000000140272000-memory.dmp

Download

memory/1300-369-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/1300-291-0x0000000140000000-0x00000001402A3000-memory.dmp

Download

memory/1476-281-0x0000000140000000-0x0000000140273000-memory.dmp

Download

memory/1536-368-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1536-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1536-76-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1536-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1920-290-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2324-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2324-366-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2372-0-0x0000000000400000-0x0000000000821000-memory.dmp

Download

memory/2372-8-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/2372-1-0x00000000025F0000-0x0000000002656000-memory.dmp

Download

memory/2372-259-0x0000000000400000-0x0000000000821000-memory.dmp

Download

memory/2448-286-0x0000000140000000-0x00000001402BF000-memory.dmp

Download

memory/2744-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2744-43-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2844-267-0x0000000140000000-0x0000000140288000-memory.dmp

Download

memory/2844-97-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2844-103-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3008-53-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3008-367-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3008-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3008-47-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3344-288-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3360-137-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3360-143-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3360-284-0x0000000140000000-0x00000001402DF000-memory.dmp

Download

memory/3364-410-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-376-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-387-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-385-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-384-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-383-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-382-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-380-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-389-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-390-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-391-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-394-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-393-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-392-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-396-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-402-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-403-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-404-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-401-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-400-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-399-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-398-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-397-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-395-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-406-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-413-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-411-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-412-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-386-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-409-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-408-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-407-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-405-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-381-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-379-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-388-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-378-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-377-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-375-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-374-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3364-373-0x000001B112080000-0x000001B112090000-memory.dmp

Download

memory/3372-12-0x0000000140000000-0x0000000140287000-memory.dmp

Download

memory/3372-334-0x0000000140000000-0x0000000140287000-memory.dmp

Download

memory/3664-87-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3664-93-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3664-296-0x0000000140000000-0x00000001402AC000-memory.dmp

Download

memory/3708-262-0x0000000140000000-0x0000000140296000-memory.dmp

Download

memory/3824-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4064-203-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4064-248-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4064-364-0x000000000C920000-0x000000000C928000-memory.dmp

Download

memory/4064-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4064-187-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4064-295-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4128-287-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4268-132-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4268-126-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4268-282-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4600-80-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4600-82-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4600-74-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4600-68-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/4600-79-0x0000000140000000-0x00000001402B2000-memory.dmp

Download

memory/4616-115-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/4616-270-0x0000000000400000-0x0000000000674000-memory.dmp

Download

memory/4616-110-0x00000000009D0000-0x0000000000A36000-memory.dmp

Download

memory/4720-349-0x0000000140000000-0x0000000140286000-memory.dmp

Download

memory/4720-38-0x0000000140000000-0x0000000140286000-memory.dmp

Download

memory/4720-39-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4720-30-0x0000000000690000-0x00000000006F0000-memory.dmp

Download