0cf3f914abc2e9ccc2f0cf6e7aa54669a72a582c2597651dccc19ccea0d1fbd4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.3MB
Sample260820-ppdctaxbjd
SHA256 0cf3f914abc2e9ccc2f0cf6e7aa54669a72a582c2597651dccc19ccea0d1fbd4
MD5 71fc12692675a1499eb74a76ff4abefe
SHA1 10d9451da299ed4fb3b77a956460544df4390978
SHA512 bffba69e41baf6b4bdf690b160aa7f5c9645ff5246926b1a1df0c23804be2956a915655d1226b0eecce095d5ddf69e77acb441bb585ef8bf7122bd81aca31bf1
SSDEEP 12288:4xPlfqhvwMQfgC8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:41lShv3NC8LwsXYHU9MPxMu
TLSH
T118651221B1C19472D8F239329D60DBA55A3EFC345F50AEDB77841BBA4E705E08E2193E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3664	alg.exe
5932	DiagnosticsHub.StandardCollector.Service.exe
3636	fxssvc.exe
5024	elevation_service.exe
2412	elevation_service.exe
6112	maintenanceservice.exe
5644	msdtc.exe
5144	OSE.EXE
5640	PerceptionSimulationService.exe
3080	perfhost.exe
5476	locator.exe
3688	SensorDataService.exe
644	snmptrap.exe
5960	spectrum.exe
3348	ssh-agent.exe
736	TieringEngineService.exe
2804	AgentService.exe
1172	vds.exe
5736	vssvc.exe
1328	wbengine.exe
260	WmiApSrv.exe
880	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fbbf26f5a3b5d25.bin	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a33f9a69f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f5a1fa79f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f93f3fa69f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000410930a79f30dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017d053a79f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd4e52a69f30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009394fba69f30dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	3636	fxssvc.exe
Token: SeRestorePrivilege	736	TieringEngineService.exe
Token: SeManageVolumePrivilege	736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2804	AgentService.exe
Token: SeBackupPrivilege	5736	vssvc.exe
Token: SeRestorePrivilege	5736	vssvc.exe
Token: SeAuditPrivilege	5736	vssvc.exe
Token: SeBackupPrivilege	1328	wbengine.exe
Token: SeRestorePrivilege	1328	wbengine.exe
Token: SeSecurityPrivilege	1328	wbengine.exe
Token: 33	880	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	880	SearchIndexer.exe
Token: SeDebugPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5084	2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3664	alg.exe
Token: SeDebugPrivilege	3664	alg.exe
Token: SeDebugPrivilege	3664	alg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4184	880	SearchIndexer.exe	114
PID 880 wrote to memory of 2984	880	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_71fc12692675a1499eb74a76ff4abefe_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3664

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5044

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2412

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5476

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3688

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:644

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5960

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4028

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4184
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 05914c82e1a8f9bef7d036b329500d3963be74947dfa83695b4bc4378cb8948e
MD5 be6a2df8b976d0d95083ea75d8bc9468
SHA1 b46ca3318d06b4b4ac0c3ea7a2c561163956eb32
SHA512 fd861c7aead28bde00b8add312150bf448c41d0cc803f697ebfce754c9792b51603523d8d4cdee6385ea2a14ec117f2e3d05737c998f718277cbaba96fa5d44a
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnC8LiUqx:13q6HjB8LjY
TLSH
T1F9D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f10b0a285f95262cd064fd45c22a73672b30b2b91f640c399e7da1be9d624239
MD5 af769988b6bb31ac8dbd94d832797915
SHA1 fbc1757e40c275c4246f9b9fba0081fcfa65c786
SHA512 8b800e5a72da829b97d1b2df35d93526ec750e9b43379001b7adc3746501fc3c8f1c704c6e0395a9f561fdbcf6fa0ba874eb961a79279fe7e961a775958cd28b
SSDEEP 12288:J1XLsswWkxy2lRq2czA78+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:HXYfDtczA78LwsXYHU9MPxMu
TLSH
T1B3750128A3D408F9EDA7917DCCA2C505E6337C5447A0E7DB03E49A6A0F336D85E3AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 0fc541bb0450f9d0b1896979646e4d011fc6ebe1b7d71fdfa6ccb127347913b2
MD5 f2d849c6ce2e76ba7936c1ca1f336de2
SHA1 0e6550295ca66c97876c801ac08caaaa5f857d77
SHA512 48d09fa59522e577ef3dc44137ea3169e72d8ff3840e34c7ff3aa6498d5c6791f81d60b5ea52c9b281c14469a74e3f9e8043624eeb851d45879c0ecaaf0bb7f0
SSDEEP 12288:/XZNYVLeyUji0h90ZD0wxpGZIVu8rHsa8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNky:x0Le5ji0hmxrrMa8LwsXYHU9MPxMu
TLSH
T15C859E26F6748731D073C0B9C5D2A68EE97230855B308ACB4286D77C3E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8619d725bcd948afeed5428fdf1301717460022f040aecf0d696239d77297254
MD5 68e622999ca155bd1b263c4c85f77dd2
SHA1 b5185dee319c446857eac626afb2287b04df593b
SHA512 bb9071cf1fb5930a5302ac49c36fc6e175e23e1fc534bef49db6f7dcdb123ab8a163f8bd3eb82feba921c9c7f52896d90003d98e173d852a5312216ad3ac4f41
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyuE8LwsXYHU9MPxMu:2/ezSC6vUzPvxHjy98LiUqx
TLSH
T112755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4cfbf302297945c865cc35ac89b24159a4dc66b62c89432dad7659796c346ff
MD5 6a0ce56fb3a87e8ce9af94777be3274b
SHA1 6207c530d2574651a538e6ce57649e9c4b9ad767
SHA512 e27036760cafbba128c0ff0d16810910aef27c6b6aafcf1c0613eb47706a50de313c8ffc25b6ca6560ee1c110ffa9c0b8acb20097300c918e5fdeec20d2bb356
SSDEEP 12288:5VJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im9838+g7FmsTL0v0vCHSwu91GPTUQw:5VbqPb88hv/l+638LwsXYHU9MPxMu
TLSH
T188559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 732d975e27db11ccc9fcd71bab26c3bdbd1f2b08e209f1cbf782ac660a282478
MD5 4196af4e856b482741e3fb07ca2600a0
SHA1 101bf15c608ea90253d37ff821659ebde446f1b4
SHA512 1a90b385ee38aef2b4c3484301c85049854d3bf011e9a1357933304729fdc05888b75c567f35d2b5759918281f74b2876e54b1cbc9dc1fbf6b7308c3cb0e685d
SSDEEP 12288:EjW8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:EjW8LwsXYHU9MPxMu
TLSH
T16A552325878938F2EBE6707AEDC1D74951276D68E8E4EFAB7450BFDA08718B0CD5012C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d56135bdb6c6fdc04fe9bf52aadcc732df15e112ddb513982b741c58aa1fe972
MD5 9d7b6bcab6e6d5845f4c5d54e43d2d48
SHA1 491d29604ce3a106b5b79c1d86699683e367e7da
SHA512 917c88de73a854630281d0eb2eb17706fe10216c2b9cc88e2afe87b091e055dcad021c0965793f6721ed79025419576ce34c1e14665e90987f50bb9c1fe93de0
SSDEEP 12288:DeBNUbTVO86UP8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:DJIUP8LwsXYHU9MPxMu
TLSH
T1AD75CF3BEE28FCE2C67A5DB99A91C700D77278304B61A3CBD164830E9E235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fd26f60dad4fc004493198f546180f70a72453c6b4fded5de6e5333b3873438d
MD5 c3f5de22dde3bac58b549e9d119aff8e
SHA1 a92338f32337fa558ae901ddcff82d3f428fd790
SHA512 66a2f4b5ab0b27ec340480f8dcc54d5986f9633c1612f3d7d482012bdde17aad726090afe5c821b6c5ace09eb3a7a85e44035265db2540c627252a862743163e
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:gQvGAdlCEL8c/yRNw5CRLjY
TLSH
T1F1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 368e15325548524cfd48f9baf020bcb2808979e615b174047b41acd504229dd7
MD5 da2d3010489c7c1a82f13294dc693cf3
SHA1 432ae9ce8d8cd8b2f4b0088b8a1fc93241edecef
SHA512 bb9e0898842bd9ca31cb8026cac3a4d583821e4d5cc744ecbd59c215aac91bbe0b5a3149461986dabe0de7f95d947769e59b1d156e02e62f86ca6c74443447f1
SSDEEP 12288:RAwSfxL/2Dc3tDLLmt0LDQewsAjp8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ygewsAjp8LwsXYHU9MPxMu
TLSH
T17375E031FE74E432C7BB0DB65B26C706143D79204BA11AC3F3E89E9E59701D26772A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c6f8db3f717318ffd0dd7351074993d9e9c5be3496e235d9aca43a712120845e
MD5 940af89ad2558becda36372a03565633
SHA1 3ada21ff33e3ed20c3403f7d3f26dae4cb141c58
SHA512 eee35b1ca9cd6c1668b107e791ea89b1a58d7f724658be695c3a97383b519dbaf06f1fa691557e2cf766200df8d983201e84c4e5b65a63be550e5b09441989a5
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHyLj:9UEtQevvqc2W1cpV2EI32yLj
TLSH
T1DF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 edc79139b853fde953304d9d65dcd77c34ba7843acf5e63ec8b630660a1bc989
MD5 bcede3b7f9a37c9260da5b8b2be94f2e
SHA1 9df743999f838bd2c128dc6c7ad94a5b80e549d0
SHA512 2ff4d30920d538f3daf3f330a4a962e16baf47cbfd45b695efb6879700d2add734e9e38794a7cc0d6bc4b4ff75e73f8a4673a793d13ff98227d9f66721d34bef
SSDEEP 49152:ZCbRquA/m2yL5zTfFiV+XenmE3/zJ8LiUqx:2oquVjnmVLjY
TLSH
T1E3D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d70a4727236769ee0d2267dc3a96952e4ee7de21051765cf94ffcb6e897dc4b
MD5 8606f13d49d5cd10c2d5878f7ee220c6
SHA1 94e60d0eda7a2c8afc7a7feed6a12d7fd0d86b03
SHA512 5e4189ffecbd2bd122a1acb90e1a1472888a67a8f5daa06c39949e008e165908b203f33109db9776afce92578bf6ebf65b8e32cc9d6964fa2756b2414f5de48d
SSDEEP 24576:qAhGLJIFoiwtA5l7S53I8LwsXYHU9MPxMu:qAMyFoiq548LiUqx
TLSH
T1D8359D81E7F955D4F5F3AAB899B68170EA76BCA95E31D20F2150D21F0E33E509D20B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 74df46309b56021a68690d8e2fd2c4012533ecb4d88eecef54327a65219c3a3e
MD5 97e8920c4d5610874d2351f10d32d49f
SHA1 c3362e32fe96733237a21f1f0a2917d93ada55cf
SHA512 5d938f7e59f53cd0aab97a56bb50713191123d37247c64630e37fb87310ac41e9e98cbae6cfac06fbaa827bc68984aef7d807ed4d50e8ef0301e1ed21f6eb9dc
SSDEEP 12288:0mw5HEjsChNGBFgl0WDm+Ck8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:xwuXOWd8LwsXYHU9MPxMu
TLSH
T1F565F14667A81CF9E9A79139C987C136F7B3BC112A61DB1F1760C75B1F33260AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4fe7f7bb95ae7490f4c2625a8d50f128492498aab2ce84f678190129d072de5c
MD5 4e24d31484b0bfa6fb3caff4186dfd7e
SHA1 c1d6fcacd31227eaa2d44a0c87b000a9c413d59e
SHA512 60406c70db63eb6c34a93c65f2258bbcfb1d98d0c909cddb4a7650b6193f23677a259523eeab3895c6c46aeb188bab415d8b8ce456799d7d75e9db1c9a83ac7a
SSDEEP 12288:WHZ1Iy58+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:2ZuS8LwsXYHU9MPxMu
TLSH
T11F55126A23D830F6E6E3613DDDD18609E372786567B693CF256087AA1F739D08E31324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c02ca02dd48390a8571c965a93923771d137068d4616d535c756e494451aebe3
MD5 0fe15cb9554f73005bb652bfb6c0da98
SHA1 5cf0737eca081f316a98dbd1a3bc226862875f35
SHA512 aa165c6d65dade4246ab67bab3147754a774a7fa49643e1414b134416177d61c1aeae31b396fc603eb36ca40519de052a7538fd3dd0f898087ad8f67d110f49a
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:ZQRQyi36YOcPQLvw2gAf+PN3YLjY
TLSH
T1D3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3a9da3de00ccf308f2bc19d5eab90e70ab467b2f776e5289e6331641bb0dd226
MD5 ea794a9d1f7ae6bfb83825cab29dd910
SHA1 c8a32dd4e386a7a96e4dc57ca5c4f71a7d23d2df
SHA512 f06fc392fa35d36c7b7f33a0f2e723f064dafc1a750a51c847b3f8ee7abd541058836b4f5a86292a90ae7960fb16ab9284b7469ff9ba67025fa1aaa4ba4bb801
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:+QRQyi36YOcPQLvw2gAf+PN3YLjY
TLSH
T157667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f7e42667c3ab03b2c461c3c946a77824b3ed6de76a232a39971a241f3ed76434
MD5 92a0ad4785ab5737a0e1899c840d311e
SHA1 decce030bcf80e3630bc5338dd6740b499cf7568
SHA512 cac26440eab59d383c4b801e90359c4f734cd2319e32b831c05b6eca7fe1eec607b445ba667a1209eddfd8ba0b91acdfa612c0e2a74428ee235e429c14df2b6a
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0C8LwsXYHU9MPxMu:w68Qg55nhheWu7PNU3/Z8LiUqx
TLSH
T190B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81d9f9c78a0563579dd703fc972154d5d5d207e61ef85b453c9a416ac15e83b9
MD5 32d7561a78e2689c719de35d213a5d3c
SHA1 70f98f6464ac443cd49d7334e9e02a77c58c04ba
SHA512 4d313cdfc576c3113cfe58d6252abaa5aef8776a6a7cefad70d6ea93ed66d418fcfbedda649b8a5e51b49b87a07695cb568ea5aaf68b2064b95c711ee095b170
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99r:7y5112gYy5azzVvL69nLKnhZXLjY
TLSH
T136167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b968b421d3049c05ce88f27b21d84b75a84db7832eddf9324500e49f80e20cec
MD5 d0f4f6a31b159dc98388d02046ad21cf
SHA1 4c0a084620ba44e9fdf9a8af8e69222deb865905
SHA512 3c061b733d35ca3d70722aa74edabfc89c2a50c06287c896a768ffa98e13587a86a80f4e1ced2f4a4f80aad21edcd2df56881f59f667149a1590144742c2bf50
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glr8LiUqx:nu6JmVxd2dwLjY
TLSH
T175D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 afaee2a2bd0e666157f3bbec81af26dc7538b56fe2472a3fe2be1d3d0531c638
MD5 16e50d0c7afe0f421e03f718508bd53a
SHA1 764576971da28d2d5cd72b49d97e470c51a79ab2
SHA512 2bf5362a5ca28f022f998c840cb79eec466e6162847eab041db98e34270038d3dce8d38e9d5991e49e3d3a45c594d503415855421cfc9f4a0ac87e0907736e1e
SSDEEP 24576:ahv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3/8LwsXYHU9MPxMu:y1hpsNoJpF1A6UU44CwH7R4xv8LiUqx
TLSH
T1D4B5AD13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef966a5aa3a11f1e1064131ca510a1a0bf00b976ec4f17176d42670b513f5982
MD5 2636ef62262549f3da8e7560256c8047
SHA1 612644c58bd925cfb9c2908da5aed48858f8228f
SHA512 4259df6dd70316046ffba0d5d8b442d17bb407513cec865a8b274ea55c0af82ddb8246a0eb02d44fc69bb8b77533ba29d47c106cf4b70f695030dd3e62e46a16
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqS8LiUqx:o5dKTi61zLjY
TLSH
T1DDC5BE13F2E940E8E0BEE674C7669232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c422c3e544603f7e182b973cf09de0b9c3c84ca8c96065468ceb9df4ec616ada
MD5 3257967b76bf822f62581c4ad6dc2dcf
SHA1 4f946b42d479aa082fd295bcc6ccf057174d13ff
SHA512 de11d5641db414e787091320b94f05027255982935d2331e42cdef16eb56cb3e02cefbfc7f8169128819fb8d9376bb9056d8f2b82df97b1d570e3d08e21669c4
SSDEEP 24576:chiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QL/8LwsXYHU9MPxMu:chtSn8EApI0figngiDn0AP5w78LiUqx
TLSH
T14B95BE13F2D900E8D05ED179C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2537fec60d5bec867c3eeac2c5090f2b8b0d1e53987c31fc4a03517fd8b8e60d
MD5 5733b8ae749c659d4dbb6e4e81f7e091
SHA1 47c4eced30343c8972d0ccaea1f4324a7f721357
SHA512 c83044efcd7d07483611ef6be6ff2f44f12c7096832f1f6933d23af587a42c467145824748fea12268cd64b3cb44d689a40a46dfd8ad09ae73aad53263c4c2e0
SSDEEP 12288:xO8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:xO8LwsXYHU9MPxMu
TLSH
T19D55233586CA28F2E9D5B1BBDDC1C34961273D6CF9E5A7EB7440EB9609B28B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2defd645c2269400c1cfc7ee1b240b513a037859891533ef5f126959e5f0a732
MD5 30fbb53d38801c3310d9e3026135c82c
SHA1 86970592985e6fb68d06af5d92831478029cd640
SHA512 253a500e46d90830fb156d8a1e0f2e1f68f16a9b5c683e998ac78b56f648f72c5cd60b6d7d02d8eedc3e6f341124dd32dbf9c6055bf7387c03601271fafbbe7a
SSDEEP 12288:AF8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:AF8LwsXYHU9MPxMu
TLSH
T10E55233586CA28F2E9D5B0BADEC1C34861273D6CF9E5A7EB7450EB9609B18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 aace027cc6ab24d4be58f87e5d7f2e80136fdd18eea624dafbc4a57ef265bcdb
MD5 3f912b595735ec9062ccf413d71fd269
SHA1 2a529f2f07588e9b8a4c8ec527225202fa6f9e52
SHA512 08361ef7f55daf759c8b594529fda226e0267f4bfbe06ec1f1b5673b28afce8686292d627fa8401178c42f6b5d0195ebd411428aedd3ad3fdaafb66f9d9d680a
SSDEEP 12288:7n8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:7n8LwsXYHU9MPxMu
TLSH
T1DA55233586DA28F2E9D571BBDEC1C34861273D6CF9E5A7EB7440EB9609B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 574fcfd358c0305739ffdb065c6b3ce7fb70c0e00779a9ace46f47f1d145df8c
MD5 5d03681434cdba955b916e088281a4e3
SHA1 0ec7df46a3e569497df2e5ecbb0b2dde56592085
SHA512 695da89ceb992e8eb3b1405c362d8e7b35982bffab8ec18052e9bf511e91f6108b6b6c9682093853b7b2d6ac4aa5d5054d828b063c78b7c099ec9ec527d968b8
SSDEEP 12288:oVo8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:n8LwsXYHU9MPxMu
TLSH
T13E552321479A14F2D8E2F17ACDC1C209E2777CA8E7B1A7EF75005B8A0EB15A0DD7066C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4b585201ee52d7d3845bf47286ec18c85511ec0c13477da35cbc110513c036ed
MD5 e93c7130fd19d6ed4009ab01ef959ecb
SHA1 dfa502c0adc49aa497423af9fea0852b7f875e3c
SHA512 4a40f7ea17b52ffbe4f02d42fcf42ca4007170efaa2490bebc8c78b5604eea28fa791ccadd38ec8386696d38a464d555c4b12c46136a8135729d6fd24b2fd68a
SSDEEP 12288:gw8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:gw8LwsXYHU9MPxMu
TLSH
T15855233586CA28F2E9D5B0BBDEC1C34861273D6CF9E5B7EB7440AB9609B18B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1317022fe920a7c210b737abc2b749747e4affbe67ee0ce8a0bdbfaa5b06174d
MD5 3a354c6eb856f63c3de7c5e991302927
SHA1 3a42220954ef48bcfe0973257b98197dd747f956
SHA512 83bf37fa41372421f3367e03196c874463723e2355b47d6c06a22a6441559b61375dbb151063c1ac424980de42ab0452684ae8efebeb0e3ca08a305478aa6424
SSDEEP 12288:UB8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:UB8LwsXYHU9MPxMu
TLSH
T12C55233586CA28F2E9D5B1BADEC1C34861273D6CF9E5A7EB7440EB9609B18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 7cc075cbbd28f063fe6692c931ff7611adab06ffc99e48a240717da197fb7e74
MD5 3f458326263cfa90fda5158d33c25b79
SHA1 08b3905f09ae769ec60d3cc547136c4977d256d6
SHA512 5dde35fc7e2520128b5b493514eb1e3d8cba09be59ad6671dde862baf35ba978294a9b81150fc3ad191fabcd289bf75c636a7107c31cf060a46ebab99810859f
SSDEEP 12288:0N8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:0N8LwsXYHU9MPxMu
TLSH
T1F6552335868A28F2EAD5B0BADEC1C34851273D6CF9E5A7EB7450EB9606B18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 5ce0302bcd4f0facfa82da8f24c7c7376d962cdbd8bc3be972d798c3fad35823
MD5 4c5a0f529518fc6324524bd737aee57a
SHA1 ea0de760d4e27302abf41830d382e829cd7bf4d4
SHA512 1f1be9767fc6c6bb5d7babc67cb33369dc47249d15928c0c5b2f591ca00b36436fdefc61fa2d5a56cf15be0b14b75386399692f826a6738eeba76c2833e49eaa
SSDEEP 12288:hiZwbzzzFEoS2cPvyl8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:kZMnzFVSOl8LwsXYHU9MPxMu
TLSH
T1DB7501A5B39018F4ECA7813ECD518906D2B27C694BB0C65F13A4376B1F733A05D39BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dde0f569316b3d4765f82213698e5a4d5af758c56e40ea0050f313c98365d2ee
MD5 f79eca59fb60eb9dbc15ed450219e0fa
SHA1 f2b6b55e6fa65c474bec8b508afb2af98955b074
SHA512 6b2e68008690491898e48ba2e78a82ef1f3d123f47ce7ccba4bfd4af095c93053de1dc1e6c81037aa8d4d95259aa441bb76a10dba073cea095f44688f6689b6d
SSDEEP 12288:ti8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ti8LwsXYHU9MPxMu
TLSH
T1A355233586CA28F2E9D571BBDEC1C74851273D6CF9E5BBEB7440AB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 52ce070432a7683dc5830ed55245e696e56cc9c244acaf20d249d048ed2b63d5
MD5 deb1c008a9504d58018bf256e47da4f8
SHA1 0762a7b020344bf2f20604120c05964b52e407a0
SHA512 5f91b8cd60cdc6064e547f1b39bf79e019776caa5253ad470ac6025df0accd6bc480b2c61a1557e4e937f474f3f4d310bbd47a2e93127430eb8f1ea0c1ad7a75
SSDEEP 12288:gm8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:gm8LwsXYHU9MPxMu
TLSH
T15E55233586CA28F2E9D570BADEC1C74851273E6CF9E5A7EB7450EB9A09B18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3edaaa4c01cfa9999de8e64c5e4c9b2c9becc8b65cdcb4afaa3f38e905566c8a
MD5 7c29ba7160866570682f8c3dcbba9c3d
SHA1 6b62bb4a4f0cc6cedf8effba4e74dfb404372a17
SHA512 38aba42930b022cc88bb570131aae4b834648b9568eaa9eb2882260dbdb2b5975a0a92cbde9a63e85eeeaae6a31642214aba83fce59c9edc7c97725770ae9636
SSDEEP 12288:eyPz5L858+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Dzy58LwsXYHU9MPxMu
TLSH
T16165021763A530F9D5B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 021bc0c01c1a26d4b100791a9c5afe188cf2dbdcf834b51f492a511f5a692425
MD5 964d11f3dcbecb39a4a4c82648cca0e3
SHA1 c0b4bac59fe746208be957d3dca266d69dbc3c59
SHA512 690b437febf2ec85c56edff47445d4618d1a0656891039cecf8d79de5737527ade0e4a1fc7bf2c9954c227392e7c24c647ddeeff6db5e0196e2b2cfa4119843c
SSDEEP 12288:ri8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ri8LwsXYHU9MPxMu
TLSH
T1E355233586CA28F2E9D571BADEC1C74851273D6CF9E5BBEB7440EB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e2a97d9c669ef72c658f73cb86e725c43f9f1fd84ef3d09c46be3b2a21b7b045
MD5 57346c1e3a2bd8aa76a811a35ac2c695
SHA1 2c70f0096bc3e413772a8332cb0afdf8c803a2f1
SHA512 857554b3e4662bba45128ce8888b9090890a5d1570428bcc0c44c298ed344c431ec2f0163d58ea8dbf97914f10704e033915dc50b7460c5fd36f026a2f01133d
SSDEEP 12288:oi8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:oi8LwsXYHU9MPxMu
TLSH
T15955233586CA28F2E9D571BBDEC1C74851273D6CF9E5BBEB7440AB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f68e590bd5c6777e62bb1fef0ec0c761f96a00c082418245e5cb71fb0f429709
MD5 38d808d879431c9b9b73ffaf2298615b
SHA1 3503637ad3caefa1690ab55904cd36d3267b706f
SHA512 4e1d5fbe9ece41baeeac600c1e21587cf5ad35a313d445bfa31d97d954dc8ccdbaf56c920bff4a14804faca4c2d77b542b59566b4f2b7aff929c7e540a9b2034
SSDEEP 12288:SyPz5L858+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Pzy58LwsXYHU9MPxMu
TLSH
T18265021763A530F9D5B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 44e2e00feb65e17da87a7d8dfe0f66590d517e3be56cfb5ec059adbdb75655a9
MD5 32fc2b7a50f562b4a19bf8d24384d636
SHA1 2a5fa3c8099e69255ad25e93732d3fa378c45840
SHA512 65e9feef652df5922e614b7c2668b5b58bd6d5dae9e6eb8894888d2d1ee50a7ac2f0e5ecfb48318d6e5ba3c48ac1ff63f3f7a87845fce4d831cf64677f6c68af
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71SNKbrh/8KBK8LwsXYHU9MPxMu:uP4m4IpOO67N8KU8LiUqx
TLSH
T1C765AE2DABDC0096D0BA917885658A49FAB1742E2F3286CB1160933D3F77EE14F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0638ce353e2bcf19387568a7fe3efbe312c102923ae9bacfc0ecc1ca3a337406
MD5 cace2a4959f26c76ed218e3ca13953db
SHA1 a1fa84fc187621abc07c96f90a5ca06bcab58115
SHA512 58090c98da438f441add37f1d1cc7840e6c7dd01e980f73a79dc98f966745906e57b20aa09e81f9e5b51dea8f7369d6910e12c7cc756ab3a251d40f99bfcf8e3
SSDEEP 12288:+8sfS8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:4S8LwsXYHU9MPxMu
TLSH
T13A650119C29811E9C0AE617ACB828645B3333C6897E1E3CB62D0FA7E0F765D09DE5717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8c67bdcd9c51a91dedf55a200dc9eae256eea8c690f6c80cd12632b7d4877cc2
MD5 2289947749425062a3a2574f3852b734
SHA1 ea15a11b11239233db07c0419c242865f58ca76c
SHA512 868488d38f18b14eb2ce5d517fc49805bb57675a3388ea2991f5b5d1da4bdf5737fd2543a99fb68056de9dfecc1815eb6428d344e9e9e5d4f97bfad1481ed6d5
SSDEEP 12288:3y8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:3y8LwsXYHU9MPxMu
TLSH
T1FC55233687DD28B2E9F57575DD81C208212B3E7CEEA5EBDBB440A79A0971CB0CD6012C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 016828ef378f0a7421b9c30869849dc4f83ffd4b528538cbe1c595bdcd4e8fab
MD5 cd159d76aba93d6fa8a26d34883c26f2
SHA1 188ae7b735b8da3126d50cc32aaf3cec9789a8a0
SHA512 589f5b88e44758f7ccee9a312445d491c68dab0c351ed665fd58833ff06936a2b69cdb4560de5a24912a0e0c41349952d00454f23ae3da08aa727c3e93ed6053
SSDEEP 24576:8oiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBq9EzwwXg/bE8LwsS:8a0h2GEkuAe73q3pp46zwwQw8LiUqx
TLSH
T14285AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 bdb4a82435f809dc777ae5cd6a0a1b44faa643b33cae3ccdaa9f9af3f1ea098a
MD5 50056c4f7c8ab5f34174c4ad9a56c1d9
SHA1 fe6ef0a3800512dce145ec719d45c6f7fd6b0df4
SHA512 d9793875f7eddc109a706615519e5dd05b374774bc8317f19e32d818a08975b0238c0c33d495aa4e5f59ec37cfa8650fa79eb9bcbcad6c4ea2f95d1959db8f51
SSDEEP 12288:ThbHjfX18+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ThbHjP18LwsXYHU9MPxMu
TLSH
T10355027E16AD20E5E5B1B17DD982860AD332BC291761A7EF2290837E0F37DE48D31B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2b12c6df0a88e81abe4b83d9f75cebc1c8372be8474a237069ef5ef963982118
MD5 e7a8e5fbea5aff5a5db55bf4508e19a9
SHA1 684bbfa7403680b8a9dc26ae7b612e5e4780ddd8
SHA512 43ad107a8b192d8efafc28a74dac006b3465356676d39abca24032ca89756db11bb9095270e03b4cbdc43357da3c9fffe838bbb34124d5d01bdc05e1d93048bf
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/d8LwsXYHU9MPxMu:/IgnaTk46ppR/d8LiUqx
TLSH
T10E45BF2DF2B910B9D8AAD136850147B5FB71782D1F209ACB0170C638AF16EE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8eaf9202614381ec331c6aefea142f3ac106df2ba0231b37660ef364a6744796
MD5 cd876771163604b2e2288657d902f035
SHA1 d21bed054e959c45c953ddc30eb464c88e39dd13
SHA512 33211b8968f142ed0818897a6e1b2909a1a1f54e1b79c0ebb6e86f7f98a332ec01639ab00dccb068c0badf2de8f4cf1f812983ccca9731ead120ced29c20fd77
SSDEEP 12288:J28+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:J28LwsXYHU9MPxMu
TLSH
T117552325428928F2D9E5B1BEDDC1C70821163E68EBE5ABEB7450FB9A05B1CF0CD7016C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 46836922c77aac0ec62deb176580ee7e07c9a408b50aee61af424c916e0bc8b7
MD5 c9410b137fcb6b27d2027d92f28770b9
SHA1 7f193612a453a3beabf3f5833cb52c83b9f0dcee
SHA512 22dbb91bb62fdac6f8736b3535f113a3f4d31c92fec30d5a56dcff3e30cc42a02fc241d6ac4ee942903a0671ad70e92b4a9e21bba3ec208fbe31eeafda5406bf
SSDEEP 12288:wOboA4LWOsvAYFT78+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:tgL3UT78LwsXYHU9MPxMu
TLSH
T1C5750115E79400F9E9BBD13CC9A28616E272785C1764E7DF03A88B661F637E18E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 5a6d49c9a6f6daf63190d907f3ed89aada112169a34199d810fb0d0277da71ac
MD5 7c94f821996e71215bf064b935665491
SHA1 ce64b928ce03cd7a2dc0e6143b53638a1db12a69
SHA512 18fc657ce0d1e722c7a550db54a86afa9c6e96d5f70517a8a3bf5649fd0211375d73c5971396f766a183fb2cdc44c352e0940b76a6f9de83eee6f4780cadc4e6
SSDEEP 12288:bpFtyOv8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:IOv8LwsXYHU9MPxMu
TLSH
T1F555022926DD20F5E5B5B13DCA82830DD372B865576267EF119082BE0FB3EF49C31A64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 28f82cd7d84ce69bf83e545df5f0dd56dcb32f07bcfb2685523f58bd2b7bda2f
MD5 658b9f46f504bbe936722d4fbb624718
SHA1 b828761551db4e19734b5574590209ce972ab2bc
SHA512 54445414d1c654ee72fbae831311f7bc2eb4a6311c2c2c24627c105a9dd58c7f2a7f6001d05f42008f59327d7ae8d7a68f4f6e9bd6623e8caddb9a9afb52a5b5
SSDEEP 24576:I7NM9YmZqmWMUkPjZM48Mv6bEhsi8LwsXYHU9MPxMu:I7cBWMpPjN8DbEhV8LiUqx
TLSH
T1FB659E2E6BEC81E5D576D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 16aed13a986e278e0ce709e3217f376257e47f5ac16f328db71936d9a72f7de1
MD5 bb4e7cbd90b91cc04e9c6d348804a859
SHA1 f92ad4f39e7b23cb33dcd3a30a33947169d2b680
SHA512 78882ba7285fb84d68c33b69f042aac3eaf0a504c7b482e4f2f64701902d401fac91491d188fae360955f3c0abbaf42dbf5958639c80a5faa6b570526bbb6756
SSDEEP 24576:gW6BApg2YuyuNDYTabvcRvNYf8km1s8LwsXYHU9MPxMu:gF2YuHNETovcvNYf8kmC8LiUqx
TLSH
T1CE857E2927ED80A4E0BBD27D85B6D246FAB2B8551B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1858a8d3f497a56ce2749388498b02a5b43d0dea16b3cc2d7205ae239a1e8f85
MD5 ce4189404b54679cda3878fb8e3567ba
SHA1 0e0d7391bcbdbcc467d5c05934acb083924a4ae9
SHA512 994b87ba7873bfc24ba9e19e7f37ca9c4771bdff53f830dcdb0dd721e6939ed7113911f0343179dbb879fc304b1295419cea2a57eea5730df9219ea012c0f5d5
SSDEEP 24576:9AFs06+Omlf3NXEbToz8LwsXYHU9MPxMu:yFs060lVXuQ8LiUqx
TLSH
T14B65AF2F62EC00D5D07ED17E8A97C91AF2B1746707255ACB0160867E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8708f5343783271ef7e1591e274d180aa33208d79c741931617bf2ab9c3fe037
MD5 c38223380b675d3e189558084554de54
SHA1 55f8229b5da44d85120d5bf2ce8451e78580230c
SHA512 52cd0df8eff31922478d408f413b660bc9479a1f54d0f76dc6647f48d72a210955c1e4ea95c06dfcc14798442c7dafb8bc96c42e520b0448c302f09c34060bb2
SSDEEP 12288:+CJnJ5D3VkrKzxC8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:PJnJ5D3W6Q8LwsXYHU9MPxMu
TLSH
T1EB75D02DD2A810F8D4B7D274819A5745FE72383D2F226ACB28B4D5353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4d31dafb95f3340edeb7bc1a450ff2a78738b5b89ab1e363da803a311b84e5fc
MD5 d39d37719c595ed41a3fc43b436ef93a
SHA1 7ca25b519149bec47343a07e92be1316daa9b61a
SHA512 dab6c373c2fe9a158f17f11fb2b6f380a325b61a29edd0916d323cf253ec074956648b3ec8178c600500eb8b1d0b8a42fe69a8b722947eef4768c9abf4bda694
SSDEEP 24576:gEPohm6/7IIXdwcXrif7qQncjlP65i3Vud8LwsXYHU9MPxMu:fo06DIKdwc+eQnSt65aVO8LiUqx
TLSH
T168956C15B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0CA2E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 7db18d0ed0e6aae44b5a1f0599a01cff989d4aa6f6d4ce5ad3de954b02aa0e44
MD5 562739f1520b46370e5e7c353828df39
SHA1 622ce8fbaba514cd08caf582f820c5b03a1152f0
SHA512 568f6066d4f8553950f796223c462e9fb155e4985121f29f14005edb0a726a657259fc191cd15213dfd0d207af597b96c033cf72000dccc90a42fa4a52b9a793
SSDEEP 12288:+EP3RMk8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:dMk8LwsXYHU9MPxMu
TLSH
T11F55126D179D30F6D5AAA07EC9818208D372F4746BA26BEF2590C37E0E739F45E34A10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 17ab9b48c371f731dc1ea446a9edda478fdc81dc475481b3835e6f54f767bc6f
MD5 be9b8fa9019521ad0b22688f0969f4d7
SHA1 9661c65221ebab6c2224548c5f12c2b984b8ce83
SHA512 b748fbcf943e5ad84eeec1d1b443bb9ac898b0ecb71d3d2a64b258db2bf476cf4f6cb4f3edafe32c14585b0196aa04bd822a7e53a2c957c59bd035f5cf97f5d4
SSDEEP 12288:3jkyF8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:3IyF8LwsXYHU9MPxMu
TLSH
T1C665121453D824E5E9F56179DE9382849636BC34AF21A7EF6090F73E1F72AE09D30B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7f10891e134c8560f3a3435bc1651263bc711b724125b9c7d9d297d95be5ac9b
MD5 d13cad2ff7152e267ad10226cde6d8eb
SHA1 5caa37113619e671a39a54923c3d939a83c37dfe
SHA512 16d8beae112cfc00e9a78716d9e99feb7e1c5e61c7c9bddc46d560e731e321fd3825e0d22b9afd028ce5183860001efa2b6a9e73215759f08791b922cba63917
SSDEEP 12288:Nn/8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:B/8LwsXYHU9MPxMu
TLSH
T128552328429A34B6EDE5717ADD81C74451223D38ABA5BBFF34D0E7B60A728E0CD7095C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 92d9c29c4398d7dbd4865b305c33bfe923d5c721640068198078beb3fd25b5c9
MD5 0b899978413cd2d086a7c031983965c8
SHA1 cbfe133e6f5c5139cde9ff55807758d9199f8e88
SHA512 1989cb3b5f0a9ae952fe9bfc45e717dee5049f9f375b1b9a58ac5c9d6e7e4acb40d8e97065de1c781c55ac5e600926bbbaee3940c50fe2d78cc4636e036849d7
SSDEEP 12288:ALQZb3C97GYnZMv5zBcKY97MD368+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:2Q9MxZKdcz97w368LwsXYHU9MPxMu
TLSH
T1D8558C2DABE9059AE177D279D5A240C3A633B4301B31D6CF2448D13D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3fea4aacd247aa73ab66025783afa27398178c6c65b6414d606e1f65eb112a2f
MD5 aa2a631edb53ca7b8b22e3ed93456b72
SHA1 943ccb220775506c50656a7a5d6249fdf376b34d
SHA512 bfe45f9a70c1a09d846ece63ba05e786d484482951d3b414f8f88f6e12df081bde61cf63027182a5628b2057716937b4858deef5582e3ecc085e4f58c379c62e
SSDEEP 12288:1yoKo28Rple9pp8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:1yoc6App8LwsXYHU9MPxMu
TLSH
T18865E01FBBAE00A2E1B6913CC9818345E773B4345B6267DB6590C73E4E639E8BD30B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d4718f6e0382322c03051b5ee1079e6cbfc6f197f7d5a418ff67b57f164b9360
MD5 3cac476964efd3ab4e2292121e0a4c45
SHA1 aa205f37bf0365fe9ed5d38b5e1a39b10bd22a48
SHA512 e6377d4819cb9d4b8a6cce7782c0930b631804630ddfb99011813f6e8922759f90dd1298d47436847b781b59a2075e9888f9bfea6fd0dca5c4461b2f78b9b90c
SSDEEP 49152:zWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKp8LiUqx:z0zuNIOLjY
TLSH
T174A57B3DA2AC00A9D8AAC375C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ea48acb8dd6d219f644f9faeceeeb46fc3bc4ab68ef17286ee7136bf0bfea5ea
MD5 0473a0f81c5f74df1c19184e91056747
SHA1 280345984c0d32a94c1ce6e3d38d35bb5336a069
SHA512 98aeda0c8e0d0b09022f64a6fe21b84590afc64ed938bdb18758d6d1f4859677164753c911f224a1794830629749edade3d66dd30ac7fb40e800d096d02c9166
SSDEEP 24576:y1QT7EcpfxR+N5AWAz3ooiYtjMqbk8LwsXYHU9MPxMu:vTDxR+N5YzTfjMP8LiUqx
TLSH
T1D055B02EA7F915E9D1BEC5799A23C502FA727821033193CB42A0C17E1E7B9D85E76F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 1b9e60065480c1588b786cb7561a6820ed0e4a9f7430f52b544c979c380811e6
MD5 45245cf0f94f3c07b88f0aa1ca5f269d
SHA1 1b36286e982037e41748c51d9964472535db25e4
SHA512 f6e0b9673fae80742d8b439e77d42492d19d8641ab1f040bad45ca9cb5d35cfb507a9831f3f5caa1f57d86ec12dfb2f5a504e1400a62c4b72c5749069e2b07e9
SSDEEP 12288:u/5T+RdOzMbFFTG+eE5NmSL+F8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:iTMdOz0FFS+FmSLo8LwsXYHU9MPxMu
TLSH
T14C75F13EA3AD14F5E47BD17DDA43C906E67238650322A6DB0690C1B92F57EE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 7840817fcc85f7928fca454c9107286fe43b9b427047dbdee82f83851f43df8f
MD5 4303b6bef367a61ceaafe7afef698ae0
SHA1 25a37962b6ecd621efdd092f07b105e117374bf6
SHA512 da61786a01bdf04c12c241d32e72663025e58da172a6096793ab79cc7fda7efa8e711a7feca365c12cb629381a12b1c1661193ed43093c5af3c467644cd46220
SSDEEP 12288:n4+78+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:378LwsXYHU9MPxMu
TLSH
T15155122D53D834E5E8B2A179DA5282459231BC7867656BFF34D0DBBA0F729E0CD30B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/260-231-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/260-225-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/644-141-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/644-147-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/644-357-0x0000000140000000-0x0000000140142000-memory.dmp

Download

memory/736-360-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/736-178-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/736-172-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/880-504-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/880-365-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/880-450-0x000000000D0C0000-0x000000000D0C8000-memory.dmp

Download

memory/880-263-0x0000000001DC0000-0x0000000001DD0000-memory.dmp

Download

memory/880-236-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/880-282-0x000000000A200000-0x000000000A208000-memory.dmp

Download

memory/880-247-0x0000000001B10000-0x0000000001B20000-memory.dmp

Download

memory/880-242-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1172-201-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1172-195-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/1172-361-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1328-221-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1328-215-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1328-363-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2412-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2412-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2412-352-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2804-188-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2804-193-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2804-191-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2804-182-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2984-459-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-469-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-460-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-461-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-457-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-456-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-458-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-462-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-463-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-464-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-465-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-466-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-468-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/2984-467-0x0000025A1A780000-0x0000025A1A790000-memory.dmp

Download

memory/3080-354-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/3348-359-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3348-162-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3348-168-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3636-455-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3636-37-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/3636-350-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3636-82-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/3636-43-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/3664-452-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3664-12-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/3664-18-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/3664-19-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/3688-448-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3688-356-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3688-446-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3688-130-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3688-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5024-47-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5024-453-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5024-53-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5084-449-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/5084-8-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5084-1-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/5084-0-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/5144-351-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5144-95-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5144-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5476-120-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5476-126-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5476-355-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/5640-105-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5640-353-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/5640-111-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5644-84-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5644-90-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5644-366-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/5736-205-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5736-211-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5736-362-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5932-33-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5932-32-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5932-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5932-454-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5960-157-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5960-151-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5960-358-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/6112-78-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/6112-74-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/6112-80-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/6112-68-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download