d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Size 1.8MB
Sample260910-ge3wqayglc
SHA256 d482b09283f69a9cb78eca64f1738004cf187d3b69058bf6c10ed438e5f9076d
MD5 52be22a71bc3c0da32f39c5a3676e872
SHA1 48f338852e99b2613a13cd9c782831a4d9c9f81f
SHA512 0e931d037b9a18b1dc7e3e79b8e2ad88534491d8785f8f9175919334ecf5006fbeb1de6e213a681813b189a9c5b7597f328c0072342d03ade4c46a7e059024f8
SSDEEP 24576:GLECPTTOIJ8a1ntsmsEv9dPWTXNyxknw4FYnshx8OfVe247:G53TLsmsmXPWTX4x4x8EVep
TLSH
T1D495F120BA72C03AC57241718D78E7A5456DB9240F3146EFF7D85B2E5E708E2AB35A33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4436	alg.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
4476	fxssvc.exe
2748	elevation_service.exe
2372	elevation_service.exe
3136	maintenanceservice.exe
1924	msdtc.exe
3220	OSE.EXE
2268	PerceptionSimulationService.exe
2028	perfhost.exe
3628	locator.exe
4472	SensorDataService.exe
916	snmptrap.exe
3184	spectrum.exe
4880	ssh-agent.exe
1252	TieringEngineService.exe
4500	AgentService.exe
4332	vds.exe
3660	vssvc.exe
4068	wbengine.exe
3232	WmiApSrv.exe
3100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95682b6ce52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008809526fe740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c896fe6ee740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003624ab6ee740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000794af06ee740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009780486fe740dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce72b96ee740dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2464	DiagnosticsHub.StandardCollector.Service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe
2748	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3396	2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
Token: SeAuditPrivilege	4476	fxssvc.exe
Token: SeRestorePrivilege	1252	TieringEngineService.exe
Token: SeManageVolumePrivilege	1252	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4500	AgentService.exe
Token: SeBackupPrivilege	3660	vssvc.exe
Token: SeRestorePrivilege	3660	vssvc.exe
Token: SeAuditPrivilege	3660	vssvc.exe
Token: SeBackupPrivilege	4068	wbengine.exe
Token: SeRestorePrivilege	4068	wbengine.exe
Token: SeSecurityPrivilege	4068	wbengine.exe
Token: 33	3100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3100	SearchIndexer.exe
Token: SeDebugPrivilege	2464	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2748	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2424	3100	SearchIndexer.exe	110
PID 3100 wrote to memory of 5092	3100	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_52be22a71bc3c0da32f39c5a3676e872_amadey_darkgate_elex_luca-stealer_lynx_medusalocker_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2232

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4472

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:916

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2424
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d5c6915089a6ff0da4d38dc516339dcd1624a9367371967bf327f87408c8fd64
MD5 267e95a68dd11a6067f010c7e3f95235
SHA1 358ee5db3d014de73c214e38cd64824287ab231a
SHA512 b8f2d195d9759802fe180f90f4934d27eb3dfe2f3edbe1199a50b030a22ea8d7c88e9cc3ddad0ddfa568ae8f2ff417b91b337b7a13b11dcf930fb9d6628eea02
SSDEEP 49152:wb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnVx4x8EVep:a3q6mjBqix8EVy
TLSH
T18BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 aaa9e5d9870a3d5041b33dd6ca37ed84984d0ed4b3c00678137b7db942c3ac5d
MD5 7948c51b1be11ba6c80586274392946f
SHA1 6061c3b4d09321d050cfa274632858f5d32e7891
SHA512 c2038cbd1bf867c9c3128783a315303b7d65186b9afac396a6f45d804049b5246ff47701b206a94f07ce946e5977df5a7cd1182ed6b40518ca42887cd3b662a4
SSDEEP 12288:v1XLsswWkxy2lRq2czAz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:NXYfDtczAzyxknw4FYnshx8OfVe247
TLSH
T18975F12877D548F9EC6B8139C9B28112E633B8554770E38B03F4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 ef356a7253cd8821dbc180cd33990fe628469e834311656f2835757c2fb4c335
MD5 00c0d4785f34d4984ac236b9de4ce3f3
SHA1 3b3e99ba148588ce5181a6a86f2d48f6ed206099
SHA512 c9a86e46d00100a12f495e42d77fcbd490fcd7f0fbfc093a6d3f3ded40af37a4137e83f308744a3b9477fffe198a3cb16751047b9815d83836d3cfe7d4829de3
SSDEEP 24576:H0Le5ji0hmxSrMSyxknw4FYnshx8OfVe247:HPji0Ao8x4x8EVep
TLSH
T18F95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 387d3ca6d9f82235e187edad00a5c93d996cdc0f84129d114bebfbde987658dd
MD5 42924dc56e2027866a80b6c3e76df26b
SHA1 3f12de1eff4bf087f266c4f8dccb2f4fa2669ead
SHA512 cb922d2fe0de092468ae7a662403cffee62057ed12e5b1cfd508f9c9ff205c6e858cb1d4c43eddeb828514df332f2dc7703246f565da105c1d2f57a0cafa544d
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWj6q8wyucyxknw4FYnshx8OfVe247:O/ezSC6vUzPv+HjyYx4x8EVep
TLSH
T1DA756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2d1c94d2fb98c7d403bdcb57963bbaf871a14580cfbe46e35cc152cddd2db9ba
MD5 0a6dfbd35c13823dab92c04a37d647cb
SHA1 b5bb927e4d7223b6c83a9a44bd6024ba098252eb
SHA512 f48e19453b7cf0ac968dd5ae62ff39be5ae4339561cf145e51bbcac8d8c5783fc1f657a179149c9354fa6055c847004a822e5e5723e723dc5ace33f5486b7cc2
SSDEEP 24576:AVbqPb88hv/l+Bvyxknw4FYnshx8OfVe247:AVO88hXl+cx4x8EVep
TLSH
T102559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ef5dd020fff5247bc43a35e6230a7a75286b5daef9eddfb3cecc3756215103df
MD5 731aa0efe16be2a698f07659f290e15c
SHA1 ab78ec882b23f00fc733eb25fd32cd5b659d2140
SHA512 0df4bfde1ae055fda6176875a039935b5c9281c72aa7a50b0dadf1cd384c4c4cd651698e885515400d592fda07dab05482acc4dedcbda6aa547b2e376af20aff
SSDEEP 12288:uaO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uaOyxknw4FYnshx8OfVe247
TLSH
T16C6523BCABDDE4E1F69E14331A7172623605BDA4DAB4C11BCB78B54EE0B0C54D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 3d58cdbe1b674ff0c91fc34ddba85ef308af6abbd4536e90065943fdefef29bf
MD5 847b5a24f3909b3199f6cb2af4484e23
SHA1 b8e162548d22850876c33f7920a200858c813efd
SHA512 5bfb38f704cb23d1988abd3aabb54a697ff327e97269f109eaaf2bff917662818848fa0ab2992d19e53ddabc3a27b2aca7a5187397f141993b3dc3e55b7c1655
SSDEEP 12288:zeBNUbTVO86Un+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zJIUnyxknw4FYnshx8OfVe247
TLSH
T11875CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2c4803f69e5b3b907fda41b07e42f74a6ac0390b82de4e90d5290b67355b6bf4
MD5 8d8f97d93a729c8e944422501c5d9df1
SHA1 39320ad45de6d7baff7cca37c698db23e70bca85
SHA512 a8f602ecbbbee5cf0d2f29ee09745423275f93e8ad0c64eaf89b4effed138ddb93e95ba61b9edda06afe57f14ecb1e24fa610d825c02a48eec9f376bfa6299f0
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:bQvGAdlCEL8c/WRNw5Cnix8EVy
TLSH
T1A4267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 38605fc941fcd4a893412e941dfa716c525b741aa021be0122b3b1a87137cdc9
MD5 c73704f013d2764739cca3f816702aff
SHA1 0b89622c902e5fca53f794e9ca6ac4572832c184
SHA512 89ca736bd2300c32ac5d3793d0f8f70d93e1c2f964549b2f0c412768a01011ff7afc641c9ab8a1948492759299f105f556f92e738dd63700fe622d5c06ded08d
SSDEEP 12288:eAwSfxL/2Dc3zDLLmt0LDQewsAjp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:D+ewsAjpyxknw4FYnshx8OfVe247
TLSH
T12485E030FE75E032C2BF0DB21B36D716142DB9604B611AC3E3F89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e91b302c0c433c447d3a15bc50c90df051cf92d36f6489ea84beab7aca5c247f
MD5 82213f3037d23454cd1557f74ee71c04
SHA1 9c9f7b7d0882b15ed8bb312fdbf6d70516b240f9
SHA512 8b1a1939676cf1117ed716dd51d7281aae8c7329f43f2ae599a029ef10e75baa32282d9c80917292f118b4c114b7f8e5ce2241d3f34d0530a8bafeb02b125dea
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHp:QUEtQevvqc2W1cpV20I32
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 858dfb15fd1a4e34ef5a5fa619dafe6f14b6cee079ced28133ebec88846006df
MD5 7a595519e04e2c56d28182c409c70452
SHA1 a64927f22f64cd705f45bb935c04f127cb0df416
SHA512 2ebfee4f677bfea59da84a24af8e99ea3323180172b74b7fbc778726eabf34078d1b563950a68800cb3bbe48dc099582c5ad17ff678f72e9e10fb4e91bab9bbc
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/zMx4x8EVep:koq2VjnmDix8EVy
TLSH
T14BD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 58f72d1527dae0c41360080e4db4d4fb816343d732d472e3bc7df63691f3fc44
MD5 4f07a6c406be467ad519cc592c5525f2
SHA1 924bed07f47a13ff3f28320920d275b95ed4aa6c
SHA512 c545ec3992b5df87bb7c238d9fc32d93d979ee281abf9d44e4da11c02c0fbec041f35f30149c0def37d40930f1b5eb3ce6ca99a6a59fb1a9024df4fb3e854629
SSDEEP 24576:AAhGL6IFoiwtA5l7S53gyxknw4FYnshx8OfVe247:AAM5Foiq5zx4x8EVep
TLSH
T12F35AD80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 282aeb9d8f3063d0fbebe4d37d7c3d1a7810600847b87647fbdda23ca7aa35a9
MD5 146e5f18592f8d935b1f8e52d31421c1
SHA1 79bf7871c50dbabc09da66c0962d962c8e083120
SHA512 6111e9fc4305452edf0dd9d40543aaf1af76dc31b718bb402d5ce85179c2a1ad032456e3f5d75d389ab63a071f88a108f421f6a99e4ff1ed5f42605c8f1db969
SSDEEP 12288:Kmw5HEjsChNrBFgl0WDm+C8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:DwumOWNyxknw4FYnshx8OfVe247
TLSH
T16175F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 56fcda9878380edc971bc584c173e5e8077f8cc3e09afed96eaa64a0181fdb02
MD5 f7621b1a1830e1ca0df67e0582e2a249
SHA1 39685abcfc8df2864698e896007e161e18399384
SHA512 76cf12534f0cc9c2da87c1fbe0892ec57924319b5a59367f9804833d11128d3b6254483d8e24b804cbad6d6e6662676476d7c7e4f7909362bdf5273f212ff905
SSDEEP 12288:jvZ1IyZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jZuqyxknw4FYnshx8OfVe247
TLSH
T1AC6512AC33E870F1E1A7113A89F15206E76274A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9fc33d709983e7b44770e98ae570a968886d5b8ea70e563fdf88ca6c302a213e
MD5 87f5f658caee5bfc6cd45d666ecb1b47
SHA1 457adedc19d49b766a58bd6eccde0fffca758c5b
SHA512 919f81bce018b485ab2774a600ad48caecb95aa3cb7cb7fe74e909fa55daab7c7fe8dc13e1bcf5f84450674402f2a8199c90cf695e8efd226e0ace719ddefe34
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U8:dQRQyi36YOcPDLvw2gAf+PN3uix8EVy
TLSH
T1BF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f7cb785f38e66c451828863911ea61c5c25b9f53fc8bf11c454c0908aa31be26
MD5 8779464e522683cfeddd076bbaf64788
SHA1 322ff14074dcec61c64ad560c7f73fd0120ddc34
SHA512 6b62b36f60f30570a98f2ea49dcc9545a15e1c75840f91bf7505709545e6ab028240a02ff0ab8c55b4804f42b0a04c2c27e563fa6e6a9290b570bd4f19cf29e4
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U8:HQRQyi36YOcPDLvw2gAf+PN3uix8EVy
TLSH
T1F5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4980989608c837a81fd9897b0509839efa907f3538523f00de1bcb951ff1b016
MD5 521b118abb8af7bc33f2f3872b249b1a
SHA1 7ecc21d3ffae9b2ab9a43347f567df88296c4c4c
SHA512 8a4a6027503c4e0487ed6b46cfa66a8ba4b42d8602845406087eaf9e487f4a5a97a659731290f0df9d6f8c857bbcf569b2bad347a9f37d891d68d8f7e2fbe615
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL06yxknw4FYnshx8Z:s68Qg55nhkeWu7PNU3/8x4x8EVep
TLSH
T169B55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c14191e4b7931e5cd4501868e6cd52669df847abd252c94d325817fb73e0e7da
MD5 ebb7e7e0dc6f0c385ef4f4cc8ecad544
SHA1 a838a830c41cdd7844abfcfb8466d0a5bb589cab
SHA512 c39f7e2529ab89d6f5dcd6bc96bf75254eefc6d6d549a4ec9793580e7cd1b0b1ad700506675236e135f6984b20f1657044fc7dd5f92d0d52b650a16f977cc091
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99C:ry5112gYy5azzVvU69nLKnhZBix8EVy
TLSH
T1C8167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 67a0ef01ce857453bd35c67d65748f8e3571e0062afa61268c320bccd519e73d
MD5 9e50fd4d2075051380799857fc93d2fb
SHA1 458a79d4d05c7bd2dc67d195c448f715988bb1f2
SHA512 d710f8bb7a8bf985198ae8b874c19d1ffdaee3bdce8565f46dcb8e703178dc30b89e63ea44df2b3e68410663d1c9d373e5d4a0607632fa4c1e48425153e52c30
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGx4x8EVep:mu6JmIxd2dGix8EVy
TLSH
T1AFD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0f33c6b8a2eae2df4f38be3ac1572f872094258f9423db8d8e533dad69b95dd9
MD5 e538fcf180f002969ed8e781fadab84f
SHA1 dcf115474d6388218c628967aa9d99fdbaf3e08e
SHA512 3415cab64882d0bb46b33a9c3b81cb522eb9069c26876dda6527660a20b94955d0caa7af7f4afb5aeac16a1b91571b3943aedf2cbe303156681b27cb3e707673
SSDEEP 49152:c1hpsNoJpF1A67U44CwH7R4xSx4x8EVep:cmifPqRDix8EVy
TLSH
T1DCB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6cb547667724839c84fd6fa5d8905883f998dc120e2f8b31d89b868aac7be1e4
MD5 f150e08c012c23369b6e5649c88ecfb6
SHA1 ece893c3a3a00d27aa384a05452d57e64fc8c190
SHA512 ece5b5ff6dea6224bb0c712162f339fc74ab49bec7957147ce0eb308d39626523c1e3918fa6f6215c29b171477f7072cb80df6cd1457d6ab4ceaf93561dcc5e2
SSDEEP 49152:wSuZQIY0Be2KkRVtOnks6NMHqFx4x8EVep:q5dKqi61Fix8EVy
TLSH
T1C1C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0078c67ff9ed5141731bd24c14cf1457a1242e1eb7d902cd7f8ccd1f2e3d2ea7
MD5 5aedc70a814866be5c19546f679f1139
SHA1 b963ade0345ce89ee05bc74ca33dcf4fe1c3f93e
SHA512 5e4db73d0538724eb6796cdce7889f62128259fbd5955cdaff5adeab1469c4dbe3f62f96bdba9f6dd5f783e03635479676efe5b7385a88c781ce15edaa42b733
SSDEEP 49152:MhtSn8EApI0figjgiDn0AP5w2x4x8EVep:tX2iWphvix8EVy
TLSH
T1EB95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1407e485ddc79d138316e4c97f30adc1c16ef113a716bc5a9233c2ffbd8ec314
MD5 2c3d1c88e06fe2fea8923d194fac0f4d
SHA1 f2892fef2e73aa2e7215cf8efb61688ef8b6dd57
SHA512 8cbbd3429d25ae31962e3cad54bd985d1fd82772289f8c1736e26ff62fa5023fdcb5d04c96cb45b7ca9fe50b2fa9fd51107fa8f05ec30b28c8cf6c314f077845
SSDEEP 12288:nG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nGyxknw4FYnshx8OfVe247
TLSH
T14765237CBBDEE5E2F50D11734A7132566609B5A5EBB1811BCB7CB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 6e96a15d941a6b5db18f850704e375164341ce597bddff8bec9df43751cb93ad
MD5 6714b9bdc39e46e6de8dc55c81edf399
SHA1 c3cd65628a0bf1b3619e5eaed937eada67f38e74
SHA512 338a8c222a1024161afbe853444647772f8a80fa7377ab08536748fb855145c9f25e853dcd09bb26ecd6cfa15a0dbdaa986f53cb24328401cfe9307813c4f3a2
SSDEEP 12288:lV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lVyxknw4FYnshx8OfVe247
TLSH
T16F65237CBBDEE5E2E50D10734B7172666609B5A5EBB1811BCB7CB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 06d30ee9d93376fdb56a918a5be212c5d8d8735afbf697ff645a198cb6d1978f
MD5 677236fe8e2b783eaa161a7f9cb3eceb
SHA1 f3c2dd23df97584341ecdfc766949748956319e6
SHA512 bac8f573fa0ca31954c99363145dd6a6e8462a9741ed8873cce5544a731dfd2853b10a8b3acfe3ab5d332575157080ea8b1fe3f76bc39cb9a46c7352447a6742
SSDEEP 12288:I/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I/yxknw4FYnshx8OfVe247
TLSH
T10865237CBBDEE5E2E14D10730B7133666609B5A5EAB1811BCB7DB00EF4B0C54A06E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 edfeea98bf18558ac74264ac242361e4152cb626884ab70678a5a3802e66de88
MD5 e7bfb805852eb24acfe39f4494effe3f
SHA1 f37032712b773f07422e4cce3ca9dd6e43956692
SHA512 206ad7434e0005c59d08a1a2058883696545152a0557c390fb1e7b3b6db5c75144fc0ea1882dd999812845a0e3cba897bbf4bfaaebac5714d3a596925393f0c7
SSDEEP 12288:jVA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Syxknw4FYnshx8OfVe247
TLSH
T14965237C7BEE90D1E45A51738A716222B365B8E4E731835FCB24710EEDB0894A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 9f433d4b276996ae47ad329af0ad5497c8c7a21a9f2e444a282a7a1f5794435b
MD5 20e533f9d1254c8cf01c3a1cdb98a1a7
SHA1 21c8736c23c43c06d13fb47618569125a19da37b
SHA512 a45de90c8df76c054efad349ce1bd77df6b18feb069716d4ca9c7cd76aeeb56c57c24e1c45264f15a950bb8e4f044de2e5d62980bb1667eb7f20f723a649ad71
SSDEEP 12288:6I+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6Iyxknw4FYnshx8OfVe247
TLSH
T19165237CBBDEE5E2E50D10730A7133667609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3cbb4c0b0366d999bb45d54c476ba88027bdb5a550b8a6107a1e3916f8954f45
MD5 bb6f96d0d46e5c668c18675de0cf1a7f
SHA1 4f0b7411cee38830067687a00d1ae5a977ff4af2
SHA512 e610012f40d57c1105015c9b0c9c64dd39b2ee6d658f2cba46d0a9df3892fb834f2e480ca6a2a99997c6e45c27bcfa5bf10027d50ea43401a701dc84d6de40e6
SSDEEP 12288:kB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kByxknw4FYnshx8OfVe247
TLSH
T18065237CBBDEE5E2E50D11730B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5812357bb136d1089cb3296086530277ce1db5e2096bc15693d3c8d69daa29b7
MD5 17fe05e31e7b6f3a6eaa7de7948d437f
SHA1 cc0d352373c6464e29002b9ee2d758d5f42e0176
SHA512 9fa0c5436f96c038ca5eb9f607c6ac5b30e93a3ef51aedd1b6c7db4b8cde0414df631d33ff0dd42d4bb47edbc61ea9b538c9e13b8914af7f2683558d7d5be79c
SSDEEP 12288:Xd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xdyxknw4FYnshx8OfVe247
TLSH
T1F065237CBBDAE5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 db550cbd7ac266e3e05f6573ee1135705a70aae4209c4f8e2d0f6a2e68ffab56
MD5 a49a18ff063a60124e98e3c6f6f610ea
SHA1 881db1665ea013bb0f518615a47587ee12d271f7
SHA512 7df2128106c2ee2b65d41b71b81dd181cca70bd29468d1012acc30d14c6a3ab76037cb427e6ede4ef10c8918d64e10c6557b3234b7b831b1d696e8610470df86
SSDEEP 12288:biZwbyzzFEoS2cPvy1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:GZMqzFVSO1yxknw4FYnshx8OfVe247
TLSH
T1347501A8B39018F4EC67413ECD659916D6B27C594B70C21F43B8362B5F736A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 e724cd385d6044042c6d41579b3eeffb16c4ba5acd9e1a6d5f906c7e97608a48
MD5 c53c076fb87ac22796c2759f425b969e
SHA1 dee81f4891f553ec8873045f81bd8687bc11915c
SHA512 88e42a210ce27920852add78645d01060b4a5d43e64ae897ac7ccfd1eaff9ed20efb966c0a976d0380fd4d991e73ab98bcd09acfc191728c5e4e6fa493d5b159
SSDEEP 12288:Ra+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Rayxknw4FYnshx8OfVe247
TLSH
T1A365237CBBDAE4E2F50D11730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 adc15dad683188b1a785cbd22d3a142b9a9038aa4400d0675a4a14c070aa09e9
MD5 f9b6f23c45ebf7c3bbabbe59f6395cc9
SHA1 8cb2435e7e03958c9a6eb96ba5032b73be65bebc
SHA512 839532f6c68c92177996952888ecb9b03e6940ceefcc455a1f024fd563416f593664a2e82d393c2b9dbf2a9b74fda75d1dfe333c183d82465103760ba30fc131
SSDEEP 12288:i++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:i+yxknw4FYnshx8OfVe247
TLSH
T14965237CBBDAE5E2F50D10730B7173666609B6A5EAB1811BCB7DB10EF0B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 2c937af56b5979f7b355bc2478117dd6bfd97b70ca17bcc7b355029dcdff9911
MD5 68aff94e14d81d8a69ccf2fd173f444e
SHA1 0ba84f8f75ecfbc42cf92a0a53e8a61687b9e966
SHA512 e77fd0a9a99bbbe47ac4e62d1055b8bcaa092b9b7c56419bdb80295c6b89c0c364e4ed779e7c1f08d36216a1e84ad9288dce8ca5af6c0edf8437791a73965210
SSDEEP 12288:2yPz5L8Z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LzyZyxknw4FYnshx8OfVe247
TLSH
T16275125B73E630F5E13A523689621602F372B8724B3086AF47A4537A6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6189c5c98f6d0e6cf494181a50770271d257909fa91eabec40750073d46b3c6f
MD5 13d3703e3832a19e2f0b6360618e973f
SHA1 5b6b3cd9ae3f2a2ad3ce288a1bfca68c849e04b8
SHA512 06521c944457f0b9d7da8d16e537104a5cf1e15fa8508832f2db1f3f787576853b7dc8eb2b7377a845e9644dda8afd2699ef1a5ebef8336a0e1f4b679dc73de0
SSDEEP 12288:ya+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yayxknw4FYnshx8OfVe247
TLSH
T10A65237CBBDAE4E2F54D11730B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 260d186cab1d84ca596b9c4983d34231fa9290cf9137b9e9c410491b627b5488
MD5 38140b20ba09c187f5fe3988ebe4be0c
SHA1 b2f7447098b81e493b6902a11d4db9188ed3c555
SHA512 5d3b8d24d073380be7ac1016e1a5deeeaf6ada432d3128db16a6af445d42406ee4909405f102e4ce4da8d375b3b62d745406b74991f5c30a9bd8343b803d9f09
SSDEEP 12288:ia+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:iayxknw4FYnshx8OfVe247
TLSH
T19565237CBBDAE4E2F54D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 00daba9810dd1ece4bac99bfca1edb702125b6b7d3d61e4ea20878f7999bbded
MD5 771c627df3c3d6ad39212ec227179a98
SHA1 5973080817ac58ca2dcb0a8f9c0af830eac6cd61
SHA512 c42e37ad0ac8a64ff162cabf101f4577d717b21487f91f478887fd675eddc91c39b1a168b524185552b6316bf07646255b5ace0af3cd72dd47cdf5bc00ae066e
SSDEEP 12288:KyPz5L8Z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:XzyZyxknw4FYnshx8OfVe247
TLSH
T1C675125B73E530F5E13A523689621602F372B8724B3086AF47A4537A6E725D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 ec1dde1be971d992feee566422a166c302542d3e763e34b6081e7a3be8768d34
MD5 c1ad68fafdfa99af46c793a52bd08b6c
SHA1 7ba104d259c1cf648b2b1395586f3131437f45d6
SHA512 7a902e75c960724cf12fe9dd4cb7a7a313c980eb9e541ff336c0cc5997c086a9ac140240894291696f6474cbf8ff32acbec8bb9ff50c642d03fe6040247b57fe
SSDEEP 24576:qTPaLl3z0zDPyxknw4FYnshx8OfVe247:qTSLlj3x4x8EVep
TLSH
T19E7501A8B39058F4EC67413BCD659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 19022c1a51043474e5985a8ddcc66f380a85bd974743048e1ba2a67906a8dd1c
MD5 e4e6175d8881ee7cc6f40871be6a3383
SHA1 cb078e5a52bf99147582d1a298a0106c0dc16081
SHA512 50b0ea494a7c34c2c3adca312da181cafa8cb58ff4258bd755b307a905f666f10a9a4ef5866cb177953b47a8d2039986c37145df4e3c3c1a4c8df773d54168e0
SSDEEP 24576:jcP4mcvIjkGOxhKP2l71nNKbrh/8KBiyxknw4FYnshx8OfVe247:YP4m4IpOO67W8Knx4x8EVep
TLSH
T1AD65BE2DABDC0096D0BA913486658A4AFAB1742A1F3286CF1160933D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 2409eb27844d116b9906eac481c245ce7cded24b3ced662f89c87ad581425e0d
MD5 0294b14eac9a24746a587c409db7a1ab
SHA1 e47766b2c737368a6c2c436edba4641cbf320b1c
SHA512 2f71498370f5a61adf26da945b3f5d6e4dfb6b77d9d6bb70d3ef13f5c79a38f07bd8be2495d9027d151460e29222cd46b66e4609485ce5abc4c5a53f03dbddce
SSDEEP 12288:A0sfq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gqyxknw4FYnshx8OfVe247
TLSH
T159750128E29852E4D06E2276CB625641B3237C6597F1C3CB97E0F53E1F719909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 caf7bff394432af0584a2e0d0b11cda0cf314161f402eefeb3c88a230e929384
MD5 c7d032c7f32c3daa61b2422d555089aa
SHA1 7f92a1540b616dcb8a5a6649b1cf7b362abd41b4
SHA512 70a528f8890b384c6dc18d730f5861469fbb02dcc1484f2786f0c15268ce57e6daf3b52795666c38d0a4b1cc7e4a12ebffed2bc6ee0bf9bb2d0d246e6d53550c
SSDEEP 12288:tK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tKyxknw4FYnshx8OfVe247
TLSH
T19F65237CA7DDE9D2F56D25730A31A221360AB6B49F70C14BDB68B11EE4B0C90D83DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 376e08d514634a702f869eadae77a1cd4b32b6ec94f76de11a369dfc396b8215
MD5 6ca9bffac225b0afa14618173bf8c93c
SHA1 e8e142672ff415494e39dba5c856b2871403c2c1
SHA512 c9daa0a83f45822e6c0bb7e9cfaf848d668e3a6d17c5ffdeabc1da59da0f388bb50a5c2a60b91502b9775598f7c9119d74d89af1152aa9d020931fdee343e1ab
SSDEEP 49152:3a0h2GEkuAe73q3pp46zwwQrx4x8EVep:3a0hNYG4JwUix8EVy
TLSH
T12685AE1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37DE84E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 f623b3f437df074b27db860276e86e5242ffd31fa8a8c75c9ba275e34bbcbf92
MD5 0a1eba2955b84c4a0ed4c829af8bfc91
SHA1 c1a03e4fe53fc62332067436270b4746b1c1f1e0
SHA512 1f507cc38cd9ac0f083df96b3be740d5601ecf67bf1d9ab31096e5a9b1ac52f7fd6d8168529aeb8c48a76026b740ec061034adb8b53f8c0e995a232fdf65d068
SSDEEP 12288:rhbHjfXl+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rhbHjPlyxknw4FYnshx8OfVe247
TLSH
T19465117C27EC20D1F175A17A86A28206E331B8651B3193EF53A5923E9F36CE45C39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7f0e68b22d6ceb0d04dd76e358cb67fb924c73f0f4c4a743c134001944326116
MD5 66613a788734974c4f93045bf848b865
SHA1 690ace45609ec67e3ea362bfd96840c0b6eadb55
SHA512 36e3f952e47ba789d52784090a241b985926587f7998edc706c083b7d8a73b90d696e599845c27a8f18391319ce5e344c927ea1f292196069538b02731d17997
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/Nyxknw4FYnshx8OfVe247:bIgnaTk46pBR/4x4x8EVep
TLSH
T15645BF2DF3B910B9D8AAD136450143B5FB71782D1F2096CB0174C538AF1AEE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 8af7febc249e015f0a3645b90db92d8afbe6f6eaefa00c4fece14bf347b3ed56
MD5 8f85a0d9de85cb4315618c60aa23ff61
SHA1 c6a7387d2f8056ebf6f8b82c8d5cfd27a8c60cd8
SHA512 6beb2995ed43344878f52d35dbdd67fcfc0d7879c20b76c51ebadba1ad6c3a42d4e8d00270b8b82176c3d4445e9849430072091dad754611e1d484f56f13ef18
SSDEEP 12288:Vu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vuyxknw4FYnshx8OfVe247
TLSH
T1AA6523BCB7DEE4D2E55D11730A7162263605B2A0AB7182DBC77DB11EE1B0CE4A03D653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6fc3edf145c319db85d70ba7b795d21ddb4e202a5c35e42f76a979ec38d300d3
MD5 498cb44e9447dd782c935fd2a518362b
SHA1 f69b21485dd05cc9c7d44d8f467ed7b65b89afd2
SHA512 973ef2bc7d616dff39cbf30a9fead40161760638725906f370eaddf29dad4e9ec5c7dbd759a7db8228ff2da0aa60754ed34ebd581ea7c4f2cece9f885ede44d4
SSDEEP 12288:eObFA4LWOsvAYFTz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HxL3UTzyxknw4FYnshx8OfVe247
TLSH
T151850158F7E400F5E86B813DC9729612E272B49D0774E3DF43A84A6A1F636E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 386edfa9dad0caccd2eb4b00d4df203c3c28be5f24d1c9a56e59cc1ce6288b7b
MD5 aa6d288258d9e0d432b3d45532974280
SHA1 8b2771c1e59447c2480c920255dd75fed3469359
SHA512 dd927ca723d3db004ae0348ffd3edd2ee3b0d461153f7744da4e31f5d8e81fb889a88db109f59d2e0d20943721843c0be9adeea4488ca5c546be7b93b9d99204
SSDEEP 12288:vpFtgOH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uOHyxknw4FYnshx8OfVe247
TLSH
T1C265022C37ED10E1E179613A8AA25309D371B465473253DF43A0917E9FB3DE8AC3EA52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d15d2f5e574832334acafebba8b3e85c143e30cc7c8ce0e18d55b52a9340b62a
MD5 2a6ee222fd2c0ac98ed0259cf2442d9e
SHA1 b66fe400cf355f332725ffec3985192c6e23ac05
SHA512 74b8e5ac5f0b2efd1002bba25454b468880cd70a9a4751412b7dde2dcb9124edbcc1bd7cebce1a698e9051e8eacffeb64ff3cc417633b845458120bd1cb702ca
SSDEEP 24576:v7NM9YqZqmWMUkPjZM48Mv6bEhsayxknw4FYnshx8OfVe247:v7cBWMpPjN8DbEhQx4x8EVep
TLSH
T1AF659E2D6BEC81E5D476D13DC9A28205F6B1B4611B318ACF5262833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 76a5205ffd7640676d813d5e7da0932ccaf0937f4a457a2912db4bb5487068b5
MD5 eb135a1d98c7ddcfb89f29a70795ee31
SHA1 0fbb8b656d78a215c519a99e87e4ef16f41d95e9
SHA512 18b4299dd674fae8b7628fced8bc3c4d64f008f658de164eef9bb9224df03c618475c6216002e21a017657333ed7a80612d33d147fffe3646ac23c35bf3972fe
SSDEEP 24576:jW6BApg2YuyuNDYTabvcdvNYf8km1kyxknw4FYnshx8OfVe247:jF2YuHNETovAvNYf8kmVx4x8EVep
TLSH
T113858D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 1777b59b623544a62e64312883ae99f9de809d1cedc5940f7547a8d07f4e95b9
MD5 bcbca0d03feb14f5c0eb943a352c529c
SHA1 4ce53c13ccb5a317dec6e0d20d76cfa6c27ec9e4
SHA512 f58332e445e348d0a9f73b45890946856ef3e9299f854b76b62e5bb525eaaad9f9420edb7bd3c31979c9c18b178c04932fd5a9bcb1604b32101d5ff50ee9d186
SSDEEP 24576:EAFs06+Omlf8NXEbToryxknw4FYnshx8OfVe247:JFs060loXuLx4x8EVep
TLSH
T10965AF2F62EC00D5D07ED17E8A97C91AF6B17463072556CB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 e19b4218688550f1866db6e80322c4b8a395bbacae5f8ea8563fcd10393c4431
MD5 26b37ec0c4674b80f206587f58dbf56b
SHA1 14fd8c0ad3fbb23421b3099916ad0c157430c06d
SHA512 90b1f5864ef4c3c2985df9d08cab740c43ba0c7f7d54d6948b9e85d421e925ddd6e9ade214d014053d1e2b48524368ff24ba58e19da55affa1689d21f0004263
SSDEEP 12288:zCJnJ5D3Vkr8zx6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OJnJ5D3Wooyxknw4FYnshx8OfVe247
TLSH
T1EF85D03CD2A810E4D4B7C274825A2756BF72343D2F226ACB58B4D5397F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d83816fc24ff4a0671b80244ea474ded8f053c4ef2d8e2a288bf66a7c1445572
MD5 baca37c1a314ec6b979cd0fc209523b7
SHA1 b8f5e288b01d3aedc833beee7a98fa4a8fe7b94d
SHA512 09f9ee0b1db682181414211352b2e2744a606b42aa4791b03a71c7147796d12c4585fb319d8116c90e5fa7abe729c56e5fd022a81828a7df29a29f8d57d52764
SSDEEP 24576:ZEPghm6/7IIXdwcXrif7qQncjlP65i3VuNyxknw4FYnshx8OfVe247:eg06DIKdwc+eQnSt65aV5x4x8EVep
TLSH
T164955C15B7EA5294E8B3CAB1CA72A1169B327C509B34F7DF0AC0C92E1D33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 98b6aac215c1082e42c0d8f5b2c91c47f09dabf82a5be48e2a3ce3bfbf6f9cb6
MD5 329a74b1373a1f433c1643ba4db5dbb9
SHA1 7246000ae2af2cd41490fb7ab658914fb5f075b8
SHA512 387c85878fbf9051cc2766e2122f6ce828e523ad5c33ce39096746f73c6d16c59e3b6b1f6087b9544381204bbf8c5eea384726580f7e43c63178c9abc57a83ce
SSDEEP 12288:eEP3RM8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9M8yxknw4FYnshx8OfVe247
TLSH
T16765026C77DDB0E1E12A513A85A18205D372F0706B6253EF87A5D23E8E72CE46D3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 e5262a47a77907fded6c7d4146d4cb7c63e4e8b0d6ded4ca222d54c9c9d41f87
MD5 cb8af91b87e6b4fadeb2a1bb37f2c4f7
SHA1 b2cf9499c726169cca59c52229a70e22157b277a
SHA512 e92fa37c5624e4989c7f3a3a7e9517ab60d7c3b0328030838c5e1a91ef3d5a1edc7d1af836598c8f50866f790eb3b545e52bb5102726b6b8e7422f63f1bc8843
SSDEEP 12288:PjkyV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PIyVyxknw4FYnshx8OfVe247
TLSH
T13875121C63D8A0D1E5B905368A7352A55B35BC309F3183DF92A0F63EAE71DD4A839B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 7275172b6e6fd6651190ea4bb8341e130a4dfa3cea18a89e1eb945f95d00a437
MD5 af802b611a12acf60431e143ba55f1b7
SHA1 73a5e3680051607e5bd305c65b8569b250878627
SHA512 b630b0db5e92982f23151051bfd21db76249730ae9ef57076f607bec32bf03f2fbd6897ba614fe4fbfbc798f5439c4ee9837d51326a68093b89d83cc6951369d
SSDEEP 12288:UG3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:93yxknw4FYnshx8OfVe247
TLSH
T10E65237C67EAB4E1E9191173063163626215B1B4AB7191AFC6F8F13EE5B0CD0A03EE53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 14891cee8179f40c592c893c019236a3a30d8d44ae2f07761de3b39884897a54
MD5 fae3a842b9c9d701169ae86a969fe425
SHA1 861adc80901f98d5f65168a4d42594aec29f4f92
SHA512 0b7c10c39075c34f794ed4bb28bf7b85eb501695bc7122567fe889a9088f3927d610d277c1ab6801e1a20cd40bce297352d33f10eb831264256c6db43466cf6a
SSDEEP 24576:iQ9MxZKdcz9dw3yyxknw4FYnshx8OfVe247:iVKZtx4x8EVep
TLSH
T107558C2DABE905DAE177D27595B250C3A633B4301B31D6CF2448D03D4D7AEE8AA78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 ae779c4cb1dada53fb113096e2655a60e096b850f68dfea63d8c0f0a50cd4231
MD5 279d24ae3b22a2fa1fde1f9d394cd5a3
SHA1 b87ffa2a7ce626747419c3c3786ca03daf67e350
SHA512 5d0f4eb6a4b1fdfd8b8283c22889863c1da718a1e26a0db8e1661ad570e4819d4111fc634290a16a43280ea9ed432d052e775c2cbd0646a7d6e4bb347e5b20d9
SSDEEP 12288:NyoKo2SRple9pp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NyocgAppyxknw4FYnshx8OfVe247
TLSH
T1D475E01FBBAD40E2E166813C89958345E773B0705B6253CB9691C33D8E739E8BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 97d4732c14a672afbd003fa0959f2afa2d103755d520922e6635c86985dee055
MD5 a2ef42edf57378567ec4eefab1d191fb
SHA1 a52022ad2ba7c750ecb6b431712d46cb4c2aab16
SHA512 5ead979c6b63522cc803afaef3fae1f8bb3016ad2c4a9b5989e63111f129ffc6f509cba48f3b48547d87eae0989c315943d1dafe6436e20a953208f6a2e72e79
SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsx4x8EVep:a0zuNI2ix8EVy
TLSH
T15BA57B3DA2EC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9eb2042577897b7040e70b8c8f0b7d66f72355d62992440bcc8426de1e96f956
MD5 b61b7919914d50a754b1511eb3c7bedf
SHA1 d80d487a0046529816a62b93419f6fbed0460474
SHA512 9e777b80ad32e3e3565329fd6d0d7cb64472eef60606e8adb37e7a046c14d82492f343d49e00855800b3c923baae91182df23e6ed53544fe1ea5c863353a8ba0
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYzjMqb8yxknw4FYnshx8OfVe247:OTDxR+N5YzTBjMyx4x8EVep
TLSH
T10855B02EA7F815E9D1BE85798A23C512FB727821033193CB42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 a96f9150895a763b7a3879db9af42ccfddc6cd4b5827342c90538015c27d0fd9
MD5 d0637d9b835e77745b92b7e189cecb52
SHA1 019ab74c7d6761a55aed66c68d02850498f9da8c
SHA512 3b1b9a3f66df993bba6f59555586b8d6b594f44f91e500044b5bec7c2068b531783853d5bcb63b0a68d6fb7b3acfdeab31098f3359c640dbdea9676e6290fbd2
SSDEEP 24576:dTMdOz0FFS+TmSLAyxknw4FYnshx8OfVe247:n0K+TmSLDx4x8EVep
TLSH
T13885F13EA3AD14E5E47BC17D9A538906F67234610322A6DB06A0C07D7FA7EE4793DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 adf91f0f13d9d7daa6c8b36659a7fd5b54819e9b5f8656f042a5ca3cec22065c
MD5 82ae37d6706f5c475abef4c8dd96101e
SHA1 2aa74b0ccdd29ce667907361b6e878e9657cc5cb
SHA512 b548b4e845d7cac4f7b48fb2a0947fbc797caab05f4882be7aaffa88e03a1235ecef83643f2b7a21392314166190fbeeb260d148f17a8cd9c30b812901440449
SSDEEP 12288:24pz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fzyxknw4FYnshx8OfVe247
TLSH
T14B65122C23EC70E0F46662328A325216A630B875673192FF6AE4E53E9F718D4D43DB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-119-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/916-276-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/1252-147-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1252-393-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/1924-70-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1924-150-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/2028-105-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/2028-163-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2028-108-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2028-100-0x00000000005F0000-0x0000000000656000-memory.dmp

Download

memory/2268-159-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/2268-92-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2268-86-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2268-94-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/2372-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2372-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2464-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2464-111-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2464-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2464-23-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2464-22-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2748-130-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2748-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2748-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2748-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3100-215-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/3100-408-0x000000000C7E0000-0x000000000C7E8000-memory.dmp

Download

memory/3100-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3100-182-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/3100-429-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3100-198-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/3136-63-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3136-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3136-65-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/3136-55-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/3136-61-0x0000000001AA0000-0x0000000001B00000-memory.dmp

Download

memory/3184-131-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3184-128-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3184-122-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3184-320-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3220-80-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3220-155-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3220-83-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3232-428-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3232-168-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3396-8-0x00000000021F0000-0x0000000002256000-memory.dmp

Download

memory/3396-2-0x00000000021F0000-0x0000000002256000-memory.dmp

Download

memory/3396-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/3396-282-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/3396-82-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/3628-167-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3628-112-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3660-410-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3660-160-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4068-411-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4068-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4332-407-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4332-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4436-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4436-107-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4472-172-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4472-333-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4472-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4476-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4476-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4500-151-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4500-153-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4880-135-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4880-144-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4880-141-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4880-378-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/5092-427-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-441-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-416-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-415-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-418-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-424-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-425-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-414-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-426-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-423-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-422-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-421-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-420-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-419-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-412-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-413-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-430-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-431-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-435-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-434-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-433-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-417-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-445-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-444-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-443-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-447-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-454-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-453-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-452-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-451-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-450-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-449-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-448-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-446-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-442-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-440-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-439-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-438-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-437-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-436-0x0000022605540000-0x0000022605550000-memory.dmp

Download

memory/5092-432-0x0000022605540000-0x0000022605550000-memory.dmp

Download