43fec22a42f7cd2597ec06b0e5c5937e78b8eeb6eda8388acfe71621ac78c51a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260922-ll5fcada83
SHA256 43fec22a42f7cd2597ec06b0e5c5937e78b8eeb6eda8388acfe71621ac78c51a
MD5 de7ba7c11ea2286b43f63703b5a598b6
SHA1 1621229a21ed3be002b774ce58c34957bdf3f702
SHA512 6a91924a34b687246b4a7110a96a62aa0c76e33f45e44418a7e577c6ac6e477ebcc8c21fb1ceffa41b344946bf99a0ba87a8d6f68685ff472d27c6ef966fd2a2
SSDEEP 49152:NKKepYeEAYOW1+M5A83M+svqia6iGpP5K9mM:YK0W1+M5NU2n
TLSH
T16AA55B1177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
84	4300	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 24 IoCs

pid	Process
4564	alg.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
5048	fxssvc.exe
2332	elevation_service.exe
2572	elevation_service.exe
3708	maintenanceservice.exe
1576	msdtc.exe
3060	OSE.EXE
4960	PerceptionSimulationService.exe
1652	perfhost.exe
1636	locator.exe
4704	SensorDataService.exe
3400	snmptrap.exe
3224	spectrum.exe
2640	ssh-agent.exe
4984	TieringEngineService.exe
1756	AgentService.exe
3968	vds.exe
2480	vssvc.exe
4920	wbengine.exe
364	WmiApSrv.exe
3436	SearchIndexer.exe
5372	Reader_sl.exe
5996	RdrServicesUpdater2_x86.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\881f715d862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaw.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reader_sl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrServicesUpdater2_x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f04b4944764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1496844764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029304a43764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016b3cf43764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000265d5c44764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dae8642764add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfd68d42764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d351ae43764add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014cd4743764add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
5996	RdrServicesUpdater2_x86.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2144	DiagnosticsHub.StandardCollector.Service.exe
2332	elevation_service.exe
2332	elevation_service.exe
2332	elevation_service.exe
2332	elevation_service.exe
2332	elevation_service.exe
2332	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	5048	fxssvc.exe
Token: SeRestorePrivilege	4984	TieringEngineService.exe
Token: SeManageVolumePrivilege	4984	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1756	AgentService.exe
Token: SeBackupPrivilege	2480	vssvc.exe
Token: SeRestorePrivilege	2480	vssvc.exe
Token: SeAuditPrivilege	2480	vssvc.exe
Token: SeBackupPrivilege	4920	wbengine.exe
Token: SeRestorePrivilege	4920	wbengine.exe
Token: SeSecurityPrivilege	4920	wbengine.exe
Token: 33	3436	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3436	SearchIndexer.exe
Token: SeDebugPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2144	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2332	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 1288	3436	SearchIndexer.exe	116
PID 3436 wrote to memory of 3852	3436	SearchIndexer.exe	117
PID 4760 wrote to memory of 5372	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	128
PID 4760 wrote to memory of 5996	4760	2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe	131

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_de7ba7c11ea2286b43f63703b5a598b6_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5372
- C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\801\RdrServicesUpdater2_x86.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\Execute\801\RdrServicesUpdater2_x86.exe" R32
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5996

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4564

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:204

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2572

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4704

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3400

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3224

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:760

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1288
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 1.4MB
SHA256 aa00b5a7c510878b9ae6b25e8ee6b9e0d8b8dc76a630cfb4ae1608f3a828b297
MD5 c0fed674e7d4bc71658999cc29d5fd30
SHA1 d183e44d78c385dd2778925d68b4730e584e9e7c
SHA512 91664be8cdc675001fe1a23cb86981b74f3d164c6322c3228e607c9f4768ca6bcd772bedd5e764639287f5738ff3f9a086b19953851536e48dcecc5478e00775
SSDEEP 12288:IFHS4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:mHSiGpxAoYmK9jSjwp
TLSH
T1BF65231337874EA1D95405B078A5A6EAC1BCEE34AF4006B3130BBF9FDC756D2687145E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 1.7MB
SHA256 d1f3fb4c053c086d751ddf4258bf79b51dddd12cf1e0b540704b5136c875e6a8
MD5 c4de8db9400f46bc67298f219a9ba841
SHA1 0cc3fead30b5fae0ef7e296e992cce2d75d51c93
SHA512 4e4cd0ff77fb0bc771c84693d6b1744a4abc5a3d814d897b4e850d0c6d90f996020903faba0c46c2398562db64088f3f24dbbc21e32ed37dd224952e8172b3b5
SSDEEP 49152:ESgouvAeFfenxyQ5XS7uQ0NIgiGpP5K9mM:ES1uxax1S7uz2n
TLSH
T198855A0267F94129F1F37B71EEB993645A77BC71AE39C50E5280125E09B0A90EE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.7MB
SHA256 47bed0b14072e522ac4aa48a341c21340c51380744094d9853f41e5ea6b0c2c1
MD5 b99a22a9d1ebd8b170110ca27907bc17
SHA1 ac3b25d57b0e96c1deeaf627c70ee59a914a3b76
SHA512 2848d6fad2eda34154574f11fbd93a90fed1320670e46bfc6386d900736f89fe9bde7a9ae1f77e12d80fad2e1d90d5859279134054bafd297d69174c6f641d5e
SSDEEP 12288:96dVWnxlMKn7nFKbltn+Ch/m6Xm4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjp:sKTAbD+OmemiGpxAoYmK9jSjwp
TLSH
T1F685E11133D1C035F1B329728ABFE728556CBD715F6881CFA3891A6E5D70AE0A931B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4c82c654f664b2d0210809ac7b46cdabac69c11f0c44c9c31e84b5956ba598c3
MD5 4b662c9a923541a1f73be115957d32b2
SHA1 a2b6f0fd8d009e2f97e50e4b935346d7235039db
SHA512 df21d5b09e066ee461d2e653565defdf8e42785ccaf1d276b022ef78ebac56b7f1065d7c6adea50c4aa97413cbf7cdd358ae4f020488d419c2d33617d0af3fbc
SSDEEP 49152:pb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn1iGpP5K9mM:/3q60jBO2n
TLSH
T11AD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 e66290666b02674732f4bd41866b5dd214fd15b2aef68800d30c8972d1539d19
MD5 5c77937e7846a7f9b812a5678f041691
SHA1 3f7a038410e3f4767d5d52c47e2c16f8888df5e2
SHA512 6852993c37f834cc00a50c488dc5b6039d72bec81da9f3423f6e211b779004abc0a443b2ffc8aa80a8ad2505f62d01edb5a51f1fac774cd574cf379d74cea49f
SSDEEP 12288:c1XLsswWkxy2lRq2czAc4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:qXYfDtczAciGpxAoYmK9jSjwp
TLSH
T1FA75012573D10CF8ED678178DCA28402E632BC554760E79B03E89A6A5F337D86D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 416313cead9f1fff99f67d0756b626927d19d54907743a0fdd96334d14357852
MD5 1a281352993bf0d6f17caf145b11dc57
SHA1 e1e0e9ed3e2712f6026959144933edc06fece8b4
SHA512 db9e5d90f4e7e94c26ef811b8419005ae771601abed68d0f17511ac07cea2605fcc8db9d449d859f24cdc488070f282f81beaf33ce5f710c1b43aeae42e0c541
SSDEEP 12288:wXZNYVLeyUji0h90ZD0wxpGZIVuNrHsd4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zp5:Q0Le5ji0hmxKrMdiGpxAoYmK9jSjwp
TLSH
T18995AE26F6748731D073C0B9C5D2A68EE97134825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b16aaef7a330f14882ed6a820d2bbdd6ae55ec34ddb403f34f533b370a6d89b4
MD5 7f3c5390ec3de2867ce0acc408eaec3d
SHA1 e2a29e3034e3fa83f2815602a638db88e4b4e69c
SHA512 de2f80bd01692b3ab16c8a792fae597e95d4eea96d3c81001535c31d94fc7a6ebcf0f9cbcefbaadd082c77945959768c81defe98c1f00206ba92b64667e5b134
SSDEEP 24576:Ia7/ezSC6vUyD/aqgrvWr6q8wyuXiGpxAoYmK9jSjwp:P/ezSC6vUzPviHjy+iGpP5K9mM
TLSH
T1A1756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1bceb6cbcd741b0e221a12c3b092660d886612d96a06a1a3405018254e84babe
MD5 4571e048c98f89f20a950286fc737f14
SHA1 b950fb7e77fde910abcb60b2fcac7f9575f1fe21
SHA512 92bdd81e668316ca95313feedddef5db7ace0dfe6412be8e2797355834e2fc846bb28367853769128eee5683f0d8dda6d8a4512e9774c37ff33e11b3736d3f80
SSDEEP 12288:KVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98o4fPt6tpm+OXhWS6rVoVlK5KZmf:KVbqPb88hv/l+boiGpxAoYmK9jSjwp
TLSH
T1A7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 2bfd1d119820330d9cb5f12cf0f465ef3d5cea67629627b86e41639c2ca53d23
MD5 998425d97e1998952492ad654f2e7545
SHA1 4497af677efe82906642d41f4db2d2b72616a77e
SHA512 17e8e8399b589b209d654b38422df5eba90c7ea393455a9d2644519837917fa110303e9a661068707a4959664016508c7f7963457daed3878023320edf138d8f
SSDEEP 12288:b/54fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:b/5iGpxAoYmK9jSjwp
TLSH
T17965232363471CE4DF6925B0F8E5B4D68264FE74A8504933125BBFDFD832A61F4A188E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 546c8832c2d6147239f82afd58d2eb8661ae257a9ddbbf7be867411bd08c897c
MD5 55defa3d02a46091635b04a5b6623926
SHA1 7fb2ddd18df1f40b10d2f459dc060ccbf70cc226
SHA512 b088edab989dd95a3a2cb0cb6413ccf3c09b1e6f918daec6636f88af5929f5c9a2d4b5527cf5fff9331d955f7e7ed11ac28ee7ede283003552866557737aace0
SSDEEP 12288:GeBNUbTVO86UQ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:GJIUQiGpxAoYmK9jSjwp
TLSH
T16875CF3BAE28FCE2C27E9DB86A918640D77278304B61A3CBD165C30EDE235E15D75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 be958f4f0676be523bfda17a04feeb55f894842f92fce3a862f685202eeb685f
MD5 b5eec5ed59e789f40898feb4fe591540
SHA1 9228fd716f796ce3c05905271b3010158b78c5fa
SHA512 bab542f66613e1e396eac8a3bb8d8ef7af8dcb420a6b2e36078d6437c54657e0805e346b62c0dc919861a33417cbfbfe83d803741e2d2bc621c0a612002c9d69
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THD:QQvGAdlCEL8c/RRNw5CB2n
TLSH
T17C267C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 4e8c8f0609b24545dd7d3fdde1cb90c3a20a63b5f0522f642a4a6cb94df60285
MD5 c1144418bc794365ac1300addfa04081
SHA1 257f72d72b5608149636397c5aa8601ed3172886
SHA512 c3fe0538df5d85d8e83c6db21088119dfefa220e68aa63ed7eee559c77798f7dd735f645849a22f2073379e8843eb0147dd537f0068d22ee62ca13eac523d0a2
SSDEEP 12288:YAwSfxL/2Dc3uDLLmt0LDQewsAja4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoS1:9bewsAjaiGpxAoYmK9jSjwp
TLSH
T18785E031FA75E436C77F0DB12B26D716542CBE204B5119C3E3A89E9E99302D22376E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 62f31fa9f96e79f610b408bcaf0c7baff0e51a110a989c976e78f8862c12fe26
MD5 7949d101a364ea68e3904b4bd21553ba
SHA1 4d397d38535723c74735b194d38ed869e35ebbc0
SHA512 5474f36a25e77e1122490e2b91ee4b5fe7011a593a16dfe1fdd8b023c7eea04f67ed5ad9848b56a6cd8a744e9b2b95e7928bde96610d6ae31d2460f710e46177
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHE:FUEtQevvqc2W1cpV2RI32E
TLSH
T1C9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23e304f2b3fabe2ee9da435bcf104ed7bf27416302f81f18d7542eaff2d5dd07
MD5 2b37eb9126df2200793e3f3fd032e618
SHA1 b6717b694eb998d82cfb35e0c0bf6f1f71e0991a
SHA512 bab73bd1fab01d55c79183b19f33e02d8c0bfcfa9a0496a2289c4b777b843e6f9955474ba4c066f1c7432407da29b05539d1ff542d85f096078092d6c93d7194
SSDEEP 49152:JCbRquA/m2yL5zQfFiV+XenmE3/z6iGpP5K9mM:GoqtVjnmN2n
TLSH
T1A9D58D0976B881E4D1F6C77896A2C647F37178154B309BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d4c21d86973bec31fe0dea4f16bc970ef3d06f2cdd93a3f3282fadf7d2dfca97
MD5 f4108e2af3e3dd8c72a1f8755572f817
SHA1 37556f65ba54d94b9ac6c163cef4612ab9ef6126
SHA512 4fff8feea348de8a466c90baf34e0fb0c8333759eeecda925d760babd19862b1c0636b84ed41516eef077fa409b39e7ff4f82da45f0bb8fef6ee197f0ca83754
SSDEEP 24576:bAhGL2IFoiwtA5l7S53riGpxAoYmK9jSjwp:bAM1Foiq57iGpP5K9mM
TLSH
T10635AE81E7F955D4F5B3AAB8A9B69071EA76BCA65E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6615d676b2136081e8bf8f1b37a335d2935b843e2e6d9fcff57a6ac5209a82bb
MD5 bea688924f8d7928666a77f2c40f74ca
SHA1 24ab76fa85c733f86e4c3cf87b78f5c3e49b0cd8
SHA512 d77c5bc9f44a3b1beb7213656c519a23e29e2ead57db9ad97269b43bf268c4db4fbffd3c108e61f6403ba9a78f40859b392f79b6a956ce2c6b98f2053b48070c
SSDEEP 12288:rmw5HEjsChNjBFgl0WDm+C34fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:qwuWOWeiGpxAoYmK9jSjwp
TLSH
T15775F04673A50CF9E9675634C597D036E7F2BC112A21CB2F1360CA5BAF33361AD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 5223d8ac61878046720d2b5db83b7a82a8e07d9a9ce7c6aadd6f829324fb87e5
MD5 cdc51ed103274614c6ff52a1ea0f1241
SHA1 f944630353a322315493bbb4321f6f64529f35c0
SHA512 079ca65d89aacc47dee19a0bec1c76aa1d14c2d0c24ef5d80e6aea59bb9c890011afbaf8440b870c9bb04b4bb0af12cddbdebdb8176681fbefe34f8b4f9c57f9
SSDEEP 12288:jLZ1IyK4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:fZuliGpxAoYmK9jSjwp
TLSH
T1F965121233D624F8D6A75174ECE19446C371BC66673043DF122A9BAF6E33AD26C35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8e6f518842541b9cd199236d5ed6b6a9ceb5965c97935480fd405f3bb8ac1b48
MD5 f7af04872d8df03a38b754cb359868ed
SHA1 0ee794ffee4eb2c4717ad2a4f7ab5d55708bad86
SHA512 af46c19ca5afcfbbbd668203cab6af9b918d687dc11be0fdffbffadb580afffa7f5ca4904fad9621ca4c37b1d8397d27a1747cfaf64be19d033c713053a253cd
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:9QRQyi36YOcPhLvw2gAf+PN3C2n
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7b53126989871267ba8cff74185132608ed640731d76492c8d6c15a69a2845d4
MD5 53b354e8e54b4bb42193718ff83347ff
SHA1 8ee2922baeb1516087670e49ba0a680b4f13f455
SHA512 9dd4883edc6552a4399237354a269af0cb84d1894019ae7ce8723a5fc12d5831556194793378e3347cfd7cf0b3b42dcc4906d0cf094e6e7dcff6f4486d52b292
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uf:qQRQyi36YOcPhLvw2gAf+PN3C2n
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a635179d0aae57eff0a7d4903b9d1aaf609cc555d0424c001548d4977d5ad6b1
MD5 b77e198daca6b7cd65457918fd6f89b0
SHA1 ab75c771005e68cbffecc0c4530714443d969642
SHA512 1d3efe481e16f317c32816280296842277604fcc97000a8ba571e2cfdc102476d2f135f72f7be24e950ff53d4718fea1e1409d98ec33ede7aa766921562abea6
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL01iGpxAoYmK9jSjY:f68Qg55nhceWu7PNU3/qiGpP5K9mM
TLSH
T1E8B54933B2F600A9C44DE1769F4A973196D17C758FE0E3DB8115720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a4bf4a9e18985d63f0307418076c37ae05884b77f0df63429b8c052a88802bd
MD5 55e1e987095d124d35ec42d9799e2908
SHA1 5baedb5595178eee33e7773da8a8d1042decff68
SHA512 3f74b04351392811076dbd0dad158897407ca54f408ffa4987706476d27b71900192287d819fa2f029cb356efcb6a4c36de35b0f278de79279b07049a15ff3da
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99V:Py5112gYy5azzVva69nLKnhZX2n
TLSH
T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8d6c83d3b149d8862bc267e1bde9eb25018179d707cc879b8c11f059631c58bc
MD5 1be185d47b24315033e131b45135b6d9
SHA1 7aebd8c0b07f68570f58b2beff29c75afbdd51e7
SHA512 5b01a62a5fade9ee76b687aad2a13a920bc95afe95744660ae5598f12cc01eb32571cd4e3a4901e8484e66e454eac74efadd02d5d146ec5aad8a39148c70944c
SSDEEP 49152:iB+taZ3usBWOBr4tEG20bqx0z+n217aau1glsiGpP5K9mM:Qu6JmUxd2dq2n
TLSH
T15DD59E13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 115d00c7912bfd301fe8245cc8d3c7fcc1977835fc6f2fdacf914da77cddb427
MD5 f32998fd18bd40bc82ad6f0c6b1c018b
SHA1 c4d5e5954a2e9ee08a6ea2370d88dcc2e4976f02
SHA512 f24078a2f4f739f3d348ee012e6f4516996cf5bc93b4d801a1fa03ce6408348ef0d4874a8e16b8dddc12cd957c6dd336acd612d98b1a09d0559150f2b1d369a0
SSDEEP 49152:I1hpsNoJpF1A6BU44CwH7R4xwiGpP5K9mM:ImifPkRN2n
TLSH
T1ECB5BE13F2D900E8D06DD17897569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee3043436a98860115705fc0101bfaadc3223a1d2222d938dbc1a484a1bd4e0e
MD5 e44b673c0011d044921a9fd80a1aa0a3
SHA1 9d802209d6affed421121a461c1dc5aba5d88930
SHA512 994e37bb0929836dcaf7f6f175ef20aaac254246f72af9c64948f1d24c00e743dabd239e56f30288d3b1e7d342796658084c4883322c7d5dc6be9a1f5ef6dd23
SSDEEP 49152:GSuZQIY0Be2KNRVtOnks6NMHqliGpP5K9mM:I5dKvi61b2n
TLSH
T12AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5c8d04cba576ffc8015b85f03ff05ec9c609ffbf2805c7ec97495403407d8000
MD5 915def785ea819e30c72b2e6659406a6
SHA1 96bbe04485d288fded22eba507a3b08820d1909e
SHA512 80f8cde470bdb65324cf976c9a4e76d8df8d2f4fb526c3afe992e0c816f3ec12a890efbca55e6f89112096df61d946f40993620592c023a6446b32cdaaa29caa
SSDEEP 49152:khtSn8EApI0figXgiDn0AP5wciGpP5K9mM:lX2iyph52n
TLSH
T18B95BE13F2D900E8D05ED174C7568632EA62BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 1bb7ea67eb46f95055a148b8f5bf40b6295ddf9f3adbd228c790773f1c09f6bf
MD5 1d5d53fefadba05474a39217d26dd117
SHA1 8f3faeb3c86f47c4625b1256da6d572c57033193
SHA512 5566e38934e82b3fb06d35aa78a89ac0cdb8b7290811a432622fefffa24e14aecaab4c907cf801133cc33463406cdf8043e78270b835d5f28e6845be3cfe4353
SSDEEP 12288:0h4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:0hiGpxAoYmK9jSjwp
TLSH
T1E465232372970DE8DA1925F0F8D5A0C6C254BE7AB5500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 219568fca7b3c70b94d29e2cfb1c57d9e404b163048c131f5bbcf4d005db03d8
MD5 9ef742ed077957778ab418cff750edab
SHA1 6cf90e00896b81b483f3dd3a4b067ae51e41ae04
SHA512 19f844a8f030c7781601ab4505cf574d668025a84dc0596e96b738e14fa6a4a5ca15de2615a5754afe6c12198c701956b04c0c87ca06e9216e16bf5e0a7977c2
SSDEEP 12288:v24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:v2iGpxAoYmK9jSjwp
TLSH
T11F65232372970DE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5b5341ab60aa39bd2627d127bb83b39f4c84c85f310cec8815487a7a5cd0e5b4
MD5 4539c0e771f63b5c4d514ed6b758fba3
SHA1 038d867a039d487535320a38d3248a716f436ebd
SHA512 31e0d2e7da32840aeb460e1815370959ec2219d59709c64e855f43b0c4d0eb8640989876264dbcc59679f5f39047d641748f9f5061b37d29893348dc0eb1166e
SSDEEP 12288:644fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:64iGpxAoYmK9jSjwp
TLSH
T1BF65232372970CE8DA5925F0F8D5A0C6C254BEBAB5500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 e8b81790fbb3b3ecbd068f8181b5602cfc41937d5ec46bac895e42ec17c14b67
MD5 3b1733054c58c48958dab9f0565f240a
SHA1 72ee06f848975776bd247457513fc57ea1b5171b
SHA512 8c3492ad52b0bd2c62351c214094959193416311a3ed86227affe7afc6efd25f6569e4429e2fe93075612cafdc2f28c3abbe9f0e1100cab6d940cf307cf28f61
SSDEEP 12288:TVL4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:tiGpxAoYmK9jSjwp
TLSH
T18365231333970CD4D965A5B0F8A2A096D3B4BDB5B72046BB13077E8F9C72BA17870C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 16bd5e15dffc1acecbc7f43487a59770671ae5b94e01876059ccf653133ee0a0
MD5 5a5071f1b38edb7d930ffe2fbef9a7ff
SHA1 1abe61e464bf04b615662c3f8502525305a4177e
SHA512 2ab94807c1e3128f44dc164ea4430f2535a263c75a9c0074eacebfdcaba95bdf1441c84d337d9ea037d051a72ac589cabf308a27bebef11ce29e3173ce3cacbd
SSDEEP 12288:8j4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:8jiGpxAoYmK9jSjwp
TLSH
T14A65232372970CE8DA5925F0F8D5A0C6C254BEBAB5500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 755629cd2f24f4487485a0d89c4eeac79cee7929dd532a27e5aacf2d8b638b4e
MD5 6c974462f55ce931481245adc067d6ce
SHA1 884a4920fd1b55d57a67dc778ab58315cc28ab76
SHA512 8ba4350b1743410f6d218ecf759b7076e3c35d0e27a4226ec3bfff60e9606f35200821f785c45d25dff2789ee01bcfa208dbc6dad15922680a17705bc99a2942
SSDEEP 12288:ii4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:iiiGpxAoYmK9jSjwp
TLSH
T1C565232372970DE8DA1925B0F8D5A0C6C254BF7AB9500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 99e4229aad442f40efbb2a926634e83f315bed22593bf54cc3e74681b3e5143e
MD5 dad604defd6d8c72ee8575123a85799f
SHA1 4c64743dc58be1d126330029c06bfc68f14c827c
SHA512 9ffb5f9bc7e981cce7562da5085eb33a583706106d5e294fb6926b4b27ed8b3a7f35d6d796402fe962cad1108e6bc06b0be724a730c695526ab4e89db04b8496
SSDEEP 12288:1u4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:1uiGpxAoYmK9jSjwp
TLSH
T15965232372970DE8DA1925B0F895A0C6C254BFBAB9504573225FFE9FE432A7174A0CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 c9f496de4c26eb8ad257e6deafc9b89fffb030d973762dfee6f9dac6160931cb
MD5 0a1ebad2641ceba7c3bcc75e37a5c1ad
SHA1 9eb47925bfac54a63ec69acd42aa866119600fe7
SHA512 a8f07e2a75b405c29898e18a0b3dcf976baab02cfb301dd45b844b4232473979623287edfd9ab920d0297db5b359d60db3c3311a7d7e2a051a61c98f37e07e14
SSDEEP 12288:WiZwbbzzFEoS2cPvyW4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:ZZMvzFVSOWiGpxAoYmK9jSjwp
TLSH
T10F750161B3911CF8EC678139CC559846D2B2BC6A1B60C61F13A9366B5F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 9ca7919985da6241e71f35b68b1109667563468a588f552dfe57c4fde0186389
MD5 db08c58932e79cd64ec4f9be859b2639
SHA1 e35504d702334299fac64727bbab123e1df36e8e
SHA512 fcd0b982130caf40c369a3fed65831bbd30a6a737f6f98ca1a814a09244f6e3376ab05288170645f6dc82000aead4d40add59ee8965abec4f86e713995110a40
SSDEEP 12288:tV4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:tViGpxAoYmK9jSjwp
TLSH
T15565232372970CE8DA5925B0F8D5A0C6C254BFBAB5500573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 97cd48f2ce586c7faa350acf253ce58285d286a7d1cc8ebe10ad5ee7523b4e7d
MD5 23fdff1d140f41a512f0b0940f8f7972
SHA1 725b9a737665c6262130446563d580572fb809e9
SHA512 849bf4692e92c1e5a3ea0877cacb0e87c11cd466fcf8f220fab8be6a87cd1f1023a3f69fa78fddd1b28ca2702981c2a9cd22e1defc0afdcc16b2e5cfd312f626
SSDEEP 12288:bp4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:bpiGpxAoYmK9jSjwp
TLSH
T1E365232372970CE8DA1925B0F8D5A0C6C258BF7AB5504573225FBE9FE832B6174A1CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 b9636a053cd1c393fe7a3d5d8732742b530542ecf29a16fff87630e3af215b88
MD5 57a27a78003fcd10ff78c9e620a2e64e
SHA1 75bbaacf54cbe2c325f40352fa51da9e42b8af29
SHA512 4c2e049cfda201009a163f5f100ddf2f516da513103b945fd47419d6dd6890b2a8d956ce6ff407134dee04c85e91195ac4cbf85631760cbecd0064fc3cec1d1b
SSDEEP 24576:dcP4mcvIjkGOxhKP2l71nNKbrh/8KBtiGpxAoYmK9jSjwp:iP4m4IpOO67W8KHiGpP5K9mM
TLSH
T1F965BE2DA7DC0096D0BB917485658A4AFAB1782E2F3286CB1160933D7F77EE14E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 41b446a879ca95718328661cbbd23aa98b5dac689f9c247e0b189820191e95a0
MD5 4ee4d091c27cb5b71bf143d468ca7b9c
SHA1 ccda665f9c3f8ddad30664810e2f721dd9245a4c
SHA512 6ba52c3eccd9df8afb1d05976092b3f0440bbee61e6defa26efd602915afb0e71e61f70032048a87dbcf7e4934fcfe6aed5fcd836fbc0c1f52d39d35d74a3a47
SSDEEP 12288:Tlsfl4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:YliGpxAoYmK9jSjwp
TLSH
T1FF750116E29906E8C06E6170DB969581F3337C6597E0C3DB13D1F97E1F32A90ACE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrManifest2.msi

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
Size 18KB
SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
TLSH
T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater2_x86.exe

Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_x86.exe
Size 846KB
SHA256 6a142c879a0676aef5c825d6fd6336800846167fab422d0f912096d286aa0070
MD5 a447c3cf3b7547e5a1e12dbb92d8c052
SHA1 d2b246eda6302534b21b2003719d9f911d0c77d3
SHA512 ce7446e337cc13a560a12b0b789813bfb5a96a6a9d25a8b3e2fc1ed884f0c4950f01937714614666befb9b92123d359b9597116e9ed9e8efd46b77a640d002ea
SSDEEP 24576:uSU4vrTQA/gK/c8DV5Wa1ZmPEKBLeiGA5nEJ:uP4j5gKU83W3FLeilVEJ
TLSH
T10C059E22EAD18073D563143102A66F368EBEB9310971D98FA3D41A4E5E705E1BB3F397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rdr756.txt

Path C:\Users\Admin\AppData\Local\Temp\Rdr756.txt
Size 13B
SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
MD5 c83301425b2ad1d496473a5ff3d9ecca
SHA1 941efb7368e46b27b937d34b07fc4d41da01b002
SHA512 83bafe4c888008afdd1b72c028c7f50dee651ca9e7d8e1b332e0bf3aa1315884155a1458a304f6e5c5627e714bf5a855a8b8d7db3f4eb2bb2789fe2f8f6a1d83
MD5 SHA1 SHA512

Submit Download

ReportUpdaterPolicy752.txt

Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy752.txt
Size 4B
SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
MD5 455831477b82574f6bf871193f2f761d
SHA1 f44217a81173869e08671753c52553646ff5d95b
SHA512 cbc0ee58e447428bdcf72fc8b03c8cfb086edbb14205b918e75ebeff1d85ff1dd254e9dcb387afbd3fa766c803937c306e0a2a79870c0d87abcb7ab93661cf85
MD5 SHA1 SHA512

Submit Download

Tmp24F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp24F5.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp2E7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp2E7C.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp5F90.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp5F90.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpA57.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpA57.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 dd0e314703f3562e38e0313fde92ab997c365fdea571ee2059277bd6046d3d74
MD5 b7371fbf77df8d6d0122cee2352cb514
SHA1 b93a89d182a36c00d03c6810deba24e0a109db5d
SHA512 0e01bc176c722a6ed1e1198ee3bdc5ac3729ff8be98b755feef94a5bd433e7e50844d2a714e50ff53594c6d940b38abee3fa2c6581220ecff4d5a16fbd6bfee2
SSDEEP 12288:LF4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:LFiGpxAoYmK9jSjwp
TLSH
T187652323639B1C94E97925B0F895E0958218BF79AF504573710FBE9FE831EA1BC7084E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 52e66440f5c159263ebed6f2ab4d1fc9794b2916f3dd6c850f80c0509feec386
MD5 cbf2e8228131c514a712a732701e5758
SHA1 7b5b72e68be652b9029b9a5ca72d8aa9b621fb9f
SHA512 98454b3463573ff1c4e718ca72e24ed560d1df999f69c6600bb2b67d3c4ca9ca2d9de9dbb2b6a76b07ba588a6c674fecdf50a73c2a2441e7c8a4e3818217c08c
SSDEEP 49152:xa0h2GEkuAe73q3pp46zwwQjiGpP5K9mM:xa0hNYG4JwE2n
TLSH
T12085AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 f988fee831f791e892143b3f019c9908f8a612004f5e377c3cd318ac71c2e281
MD5 e6250b466dde5da8338ee81e6396d9ff
SHA1 491eaa64ce84f2c6d59ad8010923e80f1e7267d5
SHA512 f07ed99972ef30912a434d008c3b3a898224bbdba61b0d7f996d75a653a31f39e6d89993d55d8bfc12afcf239e617725a37caa6c283daab2cef327200e410fef
SSDEEP 12288:QhbHjfXG4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:QhbHjPGiGpxAoYmK9jSjwp
TLSH
T13565023E22AE24D8E575A1B8E4929446C370BC35271093FF2396927E9F37EE55C31E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 7c21a351b14d7122bf51ed5b4cb31ba2d1c2a42e1bfa4ee71ffde5065b25e264
MD5 72c2cc3feb79e9224ca43276dd79cc8b
SHA1 0ff497b836775ffd7af47ded324f36cd4254e9fa
SHA512 d6b7b28e5282eea5c0f75a80be358aa814b06a5678f4c53c0d5d6e42074f9b7a57c58873278d1875ba449ac423226323347e954501d1d8f75d59eff1c57f15a8
SSDEEP 24576:C3YgnJcRTk4yti+R5dBR/eiGpxAoYmK9jSjwp:CIgnaTk46pBR/eiGpP5K9mM
TLSH
T17A45BF2EF2B910B8D8AAD136850147B5FB71782D1F209AC70174C638AF16EE89E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 567e533841c211ebac28f5cb1def81619ea236e9259be59e384c88e2b3c39d9a
MD5 ba4a9da97e8df7a3d8fe57f416aa097f
SHA1 341bd9182e8a8a0a1bc65767791fd76fd86a4191
SHA512 28be1741f8ae1d284ad615152b19a3f33bdfdcf66fad9da694b7ecddd5640900c87634bcb73f18161ca22aaeb4e54be7abed5811df8811f4adaee9131a49d68d
SSDEEP 12288:gZ4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:gZiGpxAoYmK9jSjwp
TLSH
T11665232362471CE8DA6925F0F896A0D68254BF75775006F3215FBE9FE432EF274B0889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 1109e766dcb0c5bdef7a5b63daae4dec394ff1f54e40845eb1771b2079aa624c
MD5 fc9fedb10f67612d179b70514395291b
SHA1 275d1aedb6a6bb3b6ad1268c1dd7f9127fc3f25d
SHA512 cd81d8e2a0c287847818472980c97eb2e210068478612d42639c5d3bd7795bba66eceaeb83c34ef5436beade406127d4925d7339dbd10e836410ecb193f63c97
SSDEEP 12288:1ObAA4LWOsvAYFTc4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:y4L3UTciGpxAoYmK9jSjwp
TLSH
T185850115F39504F8E97B9138C8A29516D271BC6D1760E7EF03A98F6A1E237E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 55b4f28ef9d6ee462687d4e051f59d69c8ccf3509f1b995da56c32b98da95434
MD5 7dd8987fd35b7551495750b04e6996d0
SHA1 baa52f3034812c0968e5fca80689fd284187b7d7
SHA512 45f86bfbd1cebc1833ef6e06f6673fdc5424c0286713b2c37d5414baf311897e5e053bba96ef592d2bb028e67d5dc00ed3aaba37421fe7cee5fd30a735bf4c41
SSDEEP 12288:0pFtlOw4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:eOwiGpxAoYmK9jSjwp
TLSH
T1C065012633EE14E4E539A178E892924AC370BC76172147EF029185BE5F73FF46C36A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9236021688b68de6eddf51d274f9edd3f52625db83f840a82054d26693b18ffa
MD5 ce80f5da89f9032f1d37beab6d5040c0
SHA1 4938784f8b9872c2769a9cb8e9bde108e48baa67
SHA512 cda45c55816d97877453a1581204d66cb51eb03bdd326cdc699d75f19ff289b8e7e8d74140cabcf96bf8f0e83e6f9f9ee3b52e6ffd070523a4a6d27c6675264e
SSDEEP 24576:77NM9YqZqmWMUkPjZM48Mv6bEhsViGpxAoYmK9jSjwp:77cBWMpPjN8DbEhmiGpP5K9mM
TLSH
T19965AE2E6BEC81E5D477D13DC9E28206F2B1B8611B318ADB1152833E6F37AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 33c198fa8b2e442fdc6772b01ef7f63c41c3ec065b465e047d97444a912d8fbb
MD5 4f32ab388132da75cc022c498124e3b6
SHA1 a84e0b6354c432581c32f5220668c377a8ae0494
SHA512 99e3ff014346dec0a146624a3060273ed1973e0879147e37dcd5639aaed4952c64a95e13f3cbea74b3274cea8e46bcd1835a24545f757f8da2be9d293db98d2c
SSDEEP 24576:9W6BApg2YuyuNDYTabvcdvNYf8km1viGpxAoYmK9jSjwp:9F2YuHNETovAvNYf8km1iGpP5K9mM
TLSH
T178857E2A27ED80A4E0BBD27D45B6D146FAB2BC511B3056CF0255862E1F33AF45D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 7a2c539061e48223be3f0b0069dd8b7b509f3c83c8aee10e654e47c6fb4cd1f4
MD5 0802311e5d26f98db5a60c242319f539
SHA1 2f51afce5a0230fe4b2553e61ce6c065eafefaef
SHA512 7dd1f8104d735fd63a787d937608f69839d4a9f43641ed86ec54ed4b0173ed1ec0415d434407137529afdb4188665b845b0ad572d7282852fd92209aac06ea70
SSDEEP 24576:5AFs06+OmlfQNXEbTokiGpxAoYmK9jSjwp:+Fs060lcXuDiGpP5K9mM
TLSH
T1D465AE2F62EC00D5D07ED17D8997C91AF2B1786707215ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 861d4df8c7c7d3b2c6c8df84b031ad1c1505a6825fc9fe7b22a3020894d2ebbd
MD5 fd50929673484155fab436f672a767f5
SHA1 aa90287d2c9a8129009e6741feb82c581f04ba62
SHA512 32af331db4ad83b2a8c60dd48f71ce1bd834548a4bf5301ed255cac42b83ff334f8c17792e95c30a214ef6a7cbfaf7e2fe281340d8e2f1d6a2953da972d8f8ca
SSDEEP 12288:dCJnJ5D3Vkr8zx14fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:0JnJ5D3WoDiGpxAoYmK9jSjwp
TLSH
T13885D02DD2A910E8D4B7C2B4819A1696FF71383D2F2269C72474D5357F22FE0A979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dc33e5b8c4e3ca95f3273997242e433cf5ed4a475f322d0aef7d210753542b00
MD5 abceaa4b4d2a12391b9eac25ff55160c
SHA1 5a54f0820ce8a200c26eba3356d966909fdefd5c
SHA512 a39ca73d8ff588d0c76286890c3523c7368d33071ff64ede1b6a14fb3aa27e2d69c5d3ef016cc2224cbafe39b840e014786a0ee51af8d16c0b3709253f32b9eb
SSDEEP 24576:aEPghm6/7IIXdwcXrif7qQncjlP65i3VueiGpxAoYmK9jSjwp:Ng06DIKdwc+eQnSt65aVhiGpP5K9mM
TLSH
T1ED955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 493ba08db684edc856901740190e39c0545c15f122e9f0aa7664decfc9a0c185
MD5 8aae9e71e9475553d3b2609c6f0d7b4d
SHA1 ac7b324005bd6116be60ac1813127f73ff0815ac
SHA512 211452aec2f83e750f3dd036bad1eb232bfe7b881a7dff28195cffaf5bdbb9bfc8c040fb75ea4ec8a008ab26c34855988b66d44c11932898e33d7ec5e51b9c1c
SSDEEP 12288:zEP3RM34fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:4M3iGpxAoYmK9jSjwp
TLSH
T1F365122E339E24E8D52AA078E4918145C3B1FC746B5127FF1296D67F8E33AE52D38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 7abb929cc25be732ae16a688ac5cac20f8033ba7cb8205a2c82806e30c17de75
MD5 e72e935515ce2223c054555e7feacbf5
SHA1 6e9d43c8e1ffcf79ae29ec1c4875dd324831492f
SHA512 9fa2a2b88b3220ae5018637a2d21bded0cdeea6064262968973795f590e834cef0e555a6d0bb67ba7e1eaaeb7420992f1025432b1a5f9ac5a52c72f598990687
SSDEEP 12288:Djky24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:DIy2iGpxAoYmK9jSjwp
TLSH
T186751211639918D4DA791670E8A390D58774BC306F2056EF6196FB3FAE33BE1AC30E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 3f5ca50a31cc9bd3fa8e89874ae206517227c527075cc7e3f838b1ea15d00ea4
MD5 8f50a2172a92901cdab2cee0008c47e2
SHA1 2dfcd20a14311a91b570540e268991240f7e25df
SHA512 2279d425a0632e03547c792c50f7b8183b3bfebde9cabd894c2787fbfb81c49df63732a9919f5cd08efd4aa386d0ff105125bfbc8e37f638a5f7b14531a8371d
SSDEEP 12288:CGg4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:vgiGpxAoYmK9jSjwp
TLSH
T16665232222572CE8DE2515B0F8A5A4C68264BE747B1015F721DBFEBFD933AE17071C89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4fb7fa554ae6363bdde5528c9d637948e942c44224f1f12408e02c01801a9db2
MD5 13f35dbd56753c834939c1f4b23ac27c
SHA1 7788c6079977aed4d9c1b1395971fbc65942c5d0
SHA512 ea5e010374575216bbfd9d900310e65f9ea281c0f86fa3fbbf2fffc6ddc19d7e93f6008292681d8f9fc7852694c6b41753615494ef84f73b78a10e1dcaef681a
SSDEEP 12288:7LQZb3C97GYnZMv5zBcKY9dMD394fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjp:3Q9MxZKdcz9dw39iGpxAoYmK9jSjwp
TLSH
T196558C2DABE9099AE177D275D4A250C3A633B4311B31D6CF2049D03D4D7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 ee6ffb140ef49f1d23111e1afe1c07e16d66c521f257ee3d0ad57e879c557875
MD5 c2dc34a5997d8a728a1959c6e085524b
SHA1 d33c243ae8050294498f9a432663bdbd65b5f2fe
SHA512 d44f72fcc1e57cf8d13951935fa7851c8e87a3e6336e4a6228fd8e9fb1c73dc51a76fcb098c9ed792d847c11b13d69ddfe8a358449d1ec8899e1cac9542dd28d
SSDEEP 12288:CyoKo2SRple9pa4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:CyocgApaiGpxAoYmK9jSjwp
TLSH
T13675F11FB76E04E1E1769138C8858245E773B8306B6257DB6192C73E8E33AE9BD34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b1202d36a117e9c93870fdceef0e89ac9108a816d0c9f8728d44e947592ac2e2
MD5 116a77100924eaadc71e1ea287ec187f
SHA1 a8b8409b43cc8ee1094c3e9b95832a5c90ad54fd
SHA512 23127fdb891784e17d6f04c11b0964af8cfaf1730933b59c414bb76a7b9284371dad90f63af0879a4b18e7663a09ee04c3861e9cc304b372271550cb02e17af0
SSDEEP 49152:5WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaiGpP5K9mM:h0zuNI62n
TLSH
T191A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 472B
SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
MD5 150650f8b4ce06bf6720a55c29275c38
SHA1 c69a908cd7138d119f38c8db07031364b1d21388
SHA512 fcfb7f30078c6e1c43cf272b96b5fbd599fb6ea694cbb79a7a3e40de0eea9e031a4b67d1c2f348d3ab19760b48b67758fd7b4ddd921aab9f3e8d3a064c662bd4
TLSH
T198F0651725F54655E0F75F11DBF990B35B367C456D18846CA0C8031F0CD1A51D872BB3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 596B
SHA256 550a13ba1f49e521874c12f8908b48d130519016d3abd734b9ba3e3695f2a8bd
MD5 dc1ecc554b3f04dc9600236cdecc8a5b
SHA1 5ae617e99bdded544273928e3e02147405e6a032
SHA512 5c18ad0696a910c5806e952965b6ea6a7943443714eab387cfe0437c5546b6b43c87d70495e5a21ecd284faaf545ab0b6c7fbfc5f89b27ab4779e3cef124f11b
TLSH
T168F03A5726F54668E0F35F15EEF994B31B367C026E19D4AC90C8031E0CE1A61E9727B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 726B
SHA256 c89ff4970db3664d4435522769ed127af57f09ba648689de94c00a60572db3c9
MD5 66912ae2193d013c3bf5b8b031c7a36c
SHA1 e5288840baebf03420e92c9deb1a60121f24467d
SHA512 c519bdc0aaf38be5206f763c6ec85e3b1d245ef900c36f2fdfc8865783430e62e09c53fb344e4559e939e4ac40a2fe4e81b79e396264be2dedf9a237cdfb1462
TLSH
T12B01D6962AE91235F0F35F45DFF994731A327C131E18C89C50C8410E49E1EA1E871B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 910B
SHA256 29aad3c953b84d978bd9c489ec6365d819b090264d3f63d55b4dce568fffdade
MD5 a450581a2a8b8beb8dd3de0a9d645c63
SHA1 1bba5a58b4ba51023c189f482055bd4408b20709
SHA512 603c344f420bfcd2931ec5dce59a6bea8e078d8056ebb86f61a6a79c0e4f3b3410000d67e20fa5dcd840d2b9cfc304028d69682b1e118d1c9d7ad9ce27d65a4d
TLSH
T14211C4862AE91275F0B35F45EFB994721E363C532E18C89C40C8510E0DE1EA1E972B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ee2917206a14e4028ff8592f17305defb47d765ffb1062f67368faa26d14a188
MD5 d86a9e65586545b1392881d1cb5d2eb5
SHA1 8a41d9cfefad3b2a33298501dfc8dfd9460de2b3
SHA512 d605f689cd2719462ce24c2d9e68966e2c12bd2beb2e495a05206ebd872ebc3684a7e981fc55aad44c34abf93d1d4e8b3db34dffcffbdaca7fd09297dd466a85
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYsjMqb3iGpxAoYmK9jSjwp:STDxR+N5YzTujMQiGpP5K9mM
TLSH
T14055B02EA7F915E9D1BE85789A23C502FB727821033193DB42A0C17E1E779D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 0f6d3395ed4997d3ec0d170c3cba82fefcb47e632a7505716999a31e8ff9b848
MD5 d71ab3bf1d7b038df8aa283bb4f653cb
SHA1 c22ddc6e5a6cbcd95086d1b918e27c19bafb0dc6
SHA512 9db75b8040f92319af50b3d434a0021e186a361e876b842fd1d0af97040be61bce10d75126585e9738b464e88e6a01d6a2d2fe706025b55c1b342704d1c36f35
SSDEEP 12288:G/5T+RdOzMbFFTG+eEKNmSL+24fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgx:aTMdOz0FFS+QmSLLiGpxAoYmK9jSjwp
TLSH
T17B85E13E63AE18E4E47AC27CD9438906E6727875032166DB0291C1BE6F67FE47939F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 51306379c56524d03a7d5ac4c8054b779720cdf344d26250bfe6885485b155af
MD5 0dec0a23a1b5572cf3fafa0faea5abf6
SHA1 d445dbc6430e70bf4a114ebe6ed5b82040774b96
SHA512 9b66b4cbe62816dd6634a18937a6d3a0a6b49443c67ed164f3f2f54edd0a378460dea7468b68d971a82eb9847d70cf09c0563e19ef1bf223aa27636e3697b8c6
SSDEEP 12288:O4pc4fPt6tpm+OXhWS6rVoVlK5KZmK+S4zpMqoSjwgAy:HciGpxAoYmK9jSjwp
TLSH
T1AD65121A23DA38D4E4766170E9665086C270FC75272056FF31D6EABF9F33AE1A430E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-355-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/364-435-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/1576-357-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/1636-346-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1652-181-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/1652-176-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/1652-345-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1756-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2144-106-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2144-100-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/2144-109-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2332-434-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2332-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2332-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2332-115-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2480-353-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2572-132-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2572-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2572-342-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2640-209-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2640-350-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/2640-203-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/3060-159-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3060-343-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/3060-153-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3224-192-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3224-349-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3224-198-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3400-348-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3436-232-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3436-267-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3436-431-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/3436-248-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3436-356-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3436-436-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3708-142-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3708-146-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3708-148-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3708-136-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3852-498-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-504-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-508-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-509-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-512-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-513-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-511-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-510-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-515-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-514-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-476-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-477-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-483-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-484-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-485-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-486-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-481-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-487-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-488-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-489-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-490-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-491-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-492-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-479-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-493-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-494-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-495-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-496-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-497-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-499-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-500-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-501-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-502-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-503-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-482-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-505-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-506-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-507-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-480-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3852-478-0x000001CEF0170000-0x000001CEF0180000-memory.dmp

Download

memory/3968-352-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4564-430-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4564-98-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4704-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4704-429-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4760-414-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4760-8-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/4760-794-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4760-0-0x0000000000400000-0x0000000000614000-memory.dmp

Download

memory/4760-1-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/4920-354-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4960-171-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4960-165-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4960-344-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4984-351-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/5048-112-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5048-433-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5372-646-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/5372-718-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/5372-841-0x0000000000400000-0x0000000000568000-memory.dmp

Download