aa2a41d3380c9a7b6a87a87c2b37d813b19e93f787a3af2b79bbfe434a0a17c2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 11.6MB
Sample260930-v3klyaeb24
SHA256 aa2a41d3380c9a7b6a87a87c2b37d813b19e93f787a3af2b79bbfe434a0a17c2
MD5 ad4dbf7acdf24abf9b1ad1d8088e3159
SHA1 b4593336a1c5e3309169fca95c7454421e80d9dc
SHA512 3ac420b398c802247d88204ee29a9195efb115a506b9f3dc94f5a965ffdc8926847eed59e02f17c9c6f8281649700c483b14de8ca0858cd90b2b626896ac7bbc
SSDEEP 196608:7HrB4gAtGisca+HNSSJcQGp90noYHwoQd9f2O2OKpxi8kzjTp7N0v:7HGTtfk+HMSJcQGp98i/2Di8kjR6
TLSH
T197C6D051BA02E0ABD19506784C179FAB9D3B3ED243109BC3ED9C7BED88625C612EF705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
620	alg.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2692	fxssvc.exe
1372	elevation_service.exe
5032	elevation_service.exe
4688	maintenanceservice.exe
3832	msdtc.exe
2916	OSE.EXE
3304	PerceptionSimulationService.exe
4656	perfhost.exe
1080	locator.exe
3988	SensorDataService.exe
1220	snmptrap.exe
2436	spectrum.exe
2928	ssh-agent.exe
436	TieringEngineService.exe
3496	AgentService.exe
2272	vds.exe
2420	vssvc.exe
1208	wbengine.exe
2816	WmiApSrv.exe
4428	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
\??\F:\	alg.exe
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7405a8479b11239b.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089fe52810151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0394e810151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d885c810151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047a8fe810151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1dd75820151dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000186ee4810151dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2499f810151dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2480	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2480	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe
2032	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2480	2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	2692	fxssvc.exe
Token: SeRestorePrivilege	436	TieringEngineService.exe
Token: SeManageVolumePrivilege	436	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3496	AgentService.exe
Token: SeBackupPrivilege	2420	vssvc.exe
Token: SeRestorePrivilege	2420	vssvc.exe
Token: SeAuditPrivilege	2420	vssvc.exe
Token: SeBackupPrivilege	1208	wbengine.exe
Token: SeRestorePrivilege	1208	wbengine.exe
Token: SeSecurityPrivilege	1208	wbengine.exe
Token: 33	4428	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4428	SearchIndexer.exe
Token: SeDebugPrivilege	620	alg.exe
Token: SeDebugPrivilege	620	alg.exe
Token: SeDebugPrivilege	620	alg.exe
Token: SeDebugPrivilege	2032	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2680	4428	SearchIndexer.exe	111
PID 4428 wrote to memory of 3132	4428	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ad4dbf7acdf24abf9b1ad1d8088e3159_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4172

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1080

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3988

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1220

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2436

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2928

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2680
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d4cab604d5e8a9318edf9b68cd0d6eba4a5f8d2c6e910b9207cb47ba7ef1c9c2
MD5 522af89eaa13ead5f23f0cbd79a527c8
SHA1 fb1af8ce51706952ae8043253f45eb20f62ff30f
SHA512 216b744e3ad945620607cf3c5efafa5350f00f9b849b0eb4b3c510604c00753d8d0fd6be4e451b621c6700c2408cadd787f24f5005534aa6d66eaf8238533b79
SSDEEP 49152:ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxng2LlOpbeZB7m:C3q6sjBZycv
TLSH
T177D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9cd6a179f5a865c622bb5138e0aa40853c6e889547dcdaf43975b3c34e3cd6de
MD5 f2635583414c3aa80c8f33adb7f76f40
SHA1 8898aecc77d086531251271510dad2fd81433804
SHA512 83d7ea0dfe80384aabe40af1e57608fb1c582a5f139edff636326694c72038438ce10393ae9a45695cd1c97d935142fbe45d233555efaa850fa17f90611fc0ab
SSDEEP 24576:zXYfDtczAl22C9+bmOmbTk3reZCIT59z7m:Wtc62LlOpbeZB7m
TLSH
T1F675026467E408F9DC6B823CC9A28411E633BC9587A0E7DB03E489661F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1fc03ca620a31a2ed3f610f31c4d237f69a72df9eaedcc5bcbe8da2dcec7baee
MD5 335b04d515a961630467e2bc12ad34e6
SHA1 7ff9cd8dc63c4df0737a9765417bcb7c332009e1
SHA512 655d1b496a1e86c0c515aff2f46047f00d810b240e289da18d992a310d054fb2333f172ee169841d564d38245f0a50b9dcc34296e4499553ac5e7c7b2bed87fd
SSDEEP 24576:20Le5ji0hmxxrMI22C9+bmOmbTk3reZCIT59z7m:2Pji0Ajz2LlOpbeZB7m
TLSH
T13295AE56F6748371D073C0B9C5D2A69EE97130865B308ACB4286C77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e25c0485d1a7cfaa69297d9974d3d6f0c67bca61eda5cd155e0bcdc1a6b960de
MD5 c27d9f644b063b7a948b38ef7567b3b7
SHA1 65beb370a74d8c718f7d20ebe7c2bc7b38cf0dbb
SHA512 5a42e4eb54c3e7649115bb61a4c401cc57cc2d9b13e8e57748f1d06fb80c1abba0a629c577106de854fb7646c6693c755f33d436ad18c900714e8f24782a9b01
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWn6q8wyuq22C9+bmOmbTk3reZCIT59z7m:g/ezSC6vUzPveHjyf2LlOpbeZB7m
TLSH
T187755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f0aa1ad14801a85b423f347a2bfd9e73f126fcaa025fb64e300176eb52d69e4
MD5 bd9021dafd648c5261214382a9056470
SHA1 ab69611d1aa42424541df417040facf1448b7405
SHA512 59b96b9a04b9979b3b4e87da12d272b8a24a85e94acceefb08bdefda3b16e60788ec9b21977702b8b27d77ca5177db0823ff96c86bf15d56be03092ed398806c
SSDEEP 24576:KVbqPb88hv/l+YJ22C9+bmOmbTk3reZCIT59z7m:KVO88hXl+C2LlOpbeZB7m
TLSH
T127559E66F6B48331D073C0B9C5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 8caf472fd28a75b5c5b221ad5558bc440ad5f4e8c691ae32ff093ac8be483f97
MD5 1e62e833ad2cb02d21704b2b777bf399
SHA1 e19da8e95baa4d18f95f8f253ab8d6366ad70002
SHA512 1d72c807b0c0dd358e4de88d3f02c54961829f62c875a3b9ff96c7826cbd454568bf77691d66024ce8329c958b384684fa259b32fb1ceaec28379c0a22305487
SSDEEP 12288:RLM22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:RLM22C9+bmOmbTk3reZCIT59z7m
TLSH
T1895523C18FD9C8FAC67F1230569164E56636EED8DDC6B15B81891ECF18F0BB8D04A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7c3cee95d41d4cf185f2eee0c9b2a68d0b43da737d29d17eb98d1098c19b7b45
MD5 ffba4f7759052eea6a142da9b9e07fb9
SHA1 e97c8c731c832f222568fa42159da28f028b2499
SHA512 4c149e36f3faa7e20969ee4b528de406cb76f15860847f2426a96426ff1d2d705dda765da0fb20b4751ef0d3f8d0147b2be128ba1ec501157b9718ed667563bf
SSDEEP 12288:geBNUbTVO86UR22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:gJIUR22C9+bmOmbTk3reZCIT59z7m
TLSH
T17875CF7BEE28FCE2C27E4D7857918640E77278708F52A3CBD165820E9E235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 47f3e2c7b383d8718884a18a881e7fd8e38cf65d4cb171af0b8ee56d87c48aff
MD5 06de8581c4d7adfc7fb6c04188870fe9
SHA1 4958199efad65ae7b616a50ba5b607d01c52ad10
SHA512 15d4bdedf8f9af7fee337f7d3c553269f08d7c7f754b45d6e47a7a49073c8269db1c5a024c6d2c558008aa67d9abed7d2b7380af73f76e94fcdba83c214d95f5
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THH:uQvGAdlCEL8c/DRNw5Caycv
TLSH
T174266C656BF880F5E0A7E134897AC5B2F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 721d55ed7d6b71cad61f274999680af213ec55d9f713c38ae145c7fd600d54cc
MD5 0b7697bc5f3a048c3713c6f87cddacca
SHA1 62e112bd79ade1fb079e588b1dbd5ecbea27cb18
SHA512 e55f3f3bb7f40abd498cc9582bbd5bfdb2996cb6ecd7e73f037d54a1d76690ed08269f47e0ffd851678e98b6e197c8d45e81956d75555cc028077cece8fe6604
SSDEEP 24576:00ewsAjj22C9+bmOmbTk3reZCIT59z7m:pljj2LlOpbeZB7m
TLSH
T1DA85E071FE74D436C2BF0DB11B26D716143DBA604F922AC3E3A84E8E59702D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aebef3414dcfc1aaccc796c81d12fa3c2c31b649980d97073c213faae237a560
MD5 ef108bbfbae3075d05354b873a8bbaa5
SHA1 e2bf0b90356fd34b9f363521f3ad842523ac65ad
SHA512 2523d44ce80e3f9c44c884a1d17e57ceca2e4d58ccf77064f99abdc32d04ae724935119f3a55cfa1e54191fffcdcd6137dbcba6d0ff2d5ba59141fb76a96504b
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9v:wUEtQevvqc2W1cpV2tI329
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a25356d92949aec8d8718aa04baa5aa192c791a0a9b2995735948df8533d27f
MD5 0303e6a89d374dd37bc3a14e4d24ca99
SHA1 92398ef99dd6a7cafcd2e4270e3b7433029ea99c
SHA512 9f857b22bc935f612bef14ae21a925f258cb11fb80de8e69f3587885ee41aeac64037b7cf0ae65860ae2af7ee82c6a1b86e7e6dc8e83246432196a9d6f2e7293
SSDEEP 49152:fCbRquA/m2yL5zTfFiV+XenmE3/zD2LlOpbeZB7m:4oquVjnmmycv
TLSH
T103D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c33d8835cd234ad1ca9eea53ace94b1ca63172153801f669e4e7539ee56fe6b7
MD5 874bb52fbd21d8740d392b58f2b934b5
SHA1 c515de0d4e4c218cd06f0014636c2fb55ecc88a1
SHA512 9f979be2a8cf239f5e4a0d85ff10b81a8b217baaf1efe888128ca4f512d23c65cd74120b7392d50d8dd6e5a7c8bd7eda8dd5ad540fe2e0b5fd5010e542ada785
SSDEEP 24576:OAhGL3IFoiwtA5l7S53G22C9+bmOmbTk3reZCIT59z7m:OAMUFoiq5W2LlOpbeZB7m
TLSH
T1B035AD81EBF945D4F5B7AA7899B69171EA76BCAA5E31C20F2150C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4a6c67927ede369c709acb3fc982bdb7319e5e5dcd5fade15c0b2cc5c9e1cb1c
MD5 eb29869491bd73dea5facdff6558af45
SHA1 76ba39c6d7730b2719bc91b3f7d8de5ee952418a
SHA512 594897d57950abd898c3dec1cd75af6e9684d352c408409a91a49e8a4cb5d27be18a9368a2c547a2202fb1b519c83b9fa1270ab06c55151c8e5f69889ba624c3
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CK22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+114:5wu4OW/22C9+bmOmbTk3reZCIT59z7m
TLSH
T15475F18677E90CF9E96B823885978136F7B2BC152A61D71F0360CA5B1F73361AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 7544c1c5af01153aa34955ba8315a3c12a6521da97eb59d556624d4b14281951
MD5 e587f5471ebeb69c977e45681171f232
SHA1 9c290bbaf7c880b3db1b65c5a0a525a27d5d7bc1
SHA512 fe7116698bd4c3a7d50c27006e5f31d9ea5caf702990430c44e7af805e64c6986d04f9ce2fcfa8a80aa34b0ef88902155558427dea25ec6c968153a4f4c5f7a3
SSDEEP 12288:zeZ1IyT22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:iZuQ22C9+bmOmbTk3reZCIT59z7m
TLSH
T1836512C527E860F9C1BB4238C9E15545E372B8A6ABB253CF02540A9A1F73FD59D39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6244207f53880b18758da617755ba795b7c91debecfbde72a6795d088b4662b1
MD5 46662b7446bef196d8801e35146db423
SHA1 acd07bec50630a0bdfdf24d4407e5a7bad760a5f
SHA512 eab671226ede66777b2575759312bf6a03c081b27102d0d17c348d3981e80edf94f4996323165e77abd15454119064bdf932ae8c0567a4bd759993153d4df1f2
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:GQRQyi36YOcPbLvw2gAf+PN3tycv
TLSH
T1A3667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d1308b375e51863b4744d5da35f3ff648f5010d5136cfb28caf5753c5e24385b
MD5 ecb2c5082f0bb8a0615e644f1ef1e0be
SHA1 99a1475463dc8d30ee4437ac5a9fc5d7e829bf9e
SHA512 805597407cfdeb435a4cd45f86d739dfef2a055b2638972aef7c255b58a4ec745cf8395d0ecb917771a20948d93f04161a3f509cb44b5ebbb8da7bb02cb23614
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UL:nQRQyi36YOcPbLvw2gAf+PN3tycv
TLSH
T1C3667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0030a186b9cd88e13c42f388bcf87ff762b9310416c9f0d5d0d2490b6b87f11f
MD5 089cebf8d5b94d5df95fdb50dab5dc59
SHA1 8327b1c07376789afbd12596fc85b34c4aaaec6f
SHA512 3a7638e77101e22e4ef8b37d2f2c95247b01c3fbbeb223b90fcb67155eb37839301887dc9a11f54cc0709f6fd9c5d54d5756d06625cc7f0ff1cfcb1b603707ca
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0g22C9+bmOmbTk3p:c68Qg55nhceWu7PNU3/z2LlOpbeZB7m
TLSH
T185B54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8105720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0a286d9d2d8fa3113884f953ffdeb12632637aa2f2da554e6d2d60510ea8f00c
MD5 6ea983cee4f5181c2a4fb5e4b5523406
SHA1 73f93ba3cfd35f7f87517cec46b9ee81ebdcdc08
SHA512 987a525e5da9eaf0512a6c2f3c61abc0b09e9eadd3361f4f8f47e715bce4382c131f1524625653436ceb8ab79f48ae19695d38ca85be84ab866642b6eb6ca7e0
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99B:Hy5112gYy5azzVvt69nLKnhZMycv
TLSH
T138167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c1a0ed6e5fef3968cb7a989458fee0ee3426bee4868070c9a0bc6c4302f75eb
MD5 2d01f5951f248147fe5f121a76cd182b
SHA1 638f260cad02e1535e526f93b631e597480dc3e6
SHA512 695969906e4064b1be88ade4f0130f66488c542d38d29fdd63e19230f4aeed31eb07d3e8e9cedd01aa921f4998b6ac8f5c9c1c05fe6b5e6c488064de063817c2
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl12LlOpbeZB7m:Cu6Jmdxd2d1ycv
TLSH
T16BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c671c1d697178b4361cefffced80cc85f69ac89127a77014ba90dcbcd8a5bdf7
MD5 2ebad236369b86c79d3e7d1b5d4bf499
SHA1 0d19c31a64a73fbf33b57139e0c6bfad7b8fb025
SHA512 7b5ffb667c0172b160ed7852ce1b6808f8cdd268ae03882611745fb4269aafcd726640a1ea424f3198496fb01c45307f4e6c4ef16e04dd6599c7affb36550fe6
SSDEEP 49152:p1hpsNoJpF1A63U44CwH7R4xx2LlOpbeZB7m:pmifPWRmycv
TLSH
T153B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f20916cee264e8982fb8a5b0dec1c5205b95c70b9d042814e4ba4c7c3d41e46f
MD5 6b5a1f3687bfc71469377663e2ddfe0b
SHA1 a36b17870a772e7d0ca11e9a8abc725b2931c4d2
SHA512 1e452cc9e661d0a652f73b521737747fe0eea7d4361bf6d63e781d621e9e23369b517d7f57d402de17e7b8352a043c85eccccdc5ce3254e6fe2878938531be7b
SSDEEP 49152:vSuZQIY0Be2KcRVtOnks6NMHqQ2LlOpbeZB7m:V5dKii61Qycv
TLSH
T1FDC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eeccd938f340260678a45228da70bcbc0880be2382ea02612c98adfdbcc74d57
MD5 4aad5fd43297656782e91a12c1d2149b
SHA1 a4385d887f339b8a7eab94f04647ad823b13850f
SHA512 f0553b8e8827934fc20b85f90066f80361206f8900ebc4b66c9b3c7888b0fa8539275e0a625cdb797680e6f79df1e3214be5a7b61950d9cae2ab8bfe9858b360
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wl2LlOpbeZB7m:TX2imphyycv
TLSH
T15B95BE13F2D900E8D06ED178C7568632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 19cb2b22621d87d63c5f66411c53ac7a96edcce84cee47e020e810b756e7704d
MD5 b1dd26e7d502ceebeaa29f598eed6203
SHA1 987120bdeb7ffcc6102ef87263a46366581f8ac6
SHA512 3c8185d9989f1540172b4199ab5b4d6216ec10c9dc041632bfa53092f263dbdd55ff4f75289b354b5fd66af18817aef356caf3b4ae101620b157eb069ce0b240
SSDEEP 12288:1U22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:1U22C9+bmOmbTk3reZCIT59z7m
TLSH
T1C05523C18FDEC9FAC07E5230865120E56529EEDDEEC7619B428D0D4B2AF1FF8944A14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 dc373d88a50c6db0ce9d0ac28cd0385a970241d389983e866cf8132eda7d7093
MD5 4a393d3f3df88bac08a3f33bb1c384ae
SHA1 2ec7cc2dd631261138aa29f74ad110eb06b66bb5
SHA512 042a8dd355ba82d0372e8aad0e850d98cf67043512f2efb5d88e4c8d0e22333292b566fbf00c13860712925cc87af273e55d61fe97f7969dbf91f5eddc27d86a
SSDEEP 12288:8X22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:8X22C9+bmOmbTk3reZCIT59z7m
TLSH
T14E5523C18FDEC9FAC03E5230465120E56529EEDDEEC7619B428D0C4B2AF1FF8A44A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 2bf4aa8c12ca06297163d3c59a3d948121bdb5c1c1d644e4f3121f9a557f3070
MD5 cda117471e67f7c8dfc7116b2f8c2fd7
SHA1 b259587fd13cc4bb1277c4373265500089c2a302
SHA512 bf3d9e9a1d6a7b94e104826105537a5e99b2f4fbe790084357b65bbe9bef0f13830d4e71c7d58b46cb3a87c131bd6549a398ff05061c816d314d445751e38c0b
SSDEEP 12288:UZ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:UZ22C9+bmOmbTk3reZCIT59z7m
TLSH
T11A5523C18FDEC9FAC07E5230465120E56529EEDDEEC7619B828E0C4B2AF1FF8944954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3dcf30f23b1bbee212ec9ff7528b998a8ad8e1a8cf80505d268343223ceb6404
MD5 b9d3ec8880fef01438e07f90457f7ba8
SHA1 b7418bfcd4ecaf0694cd20f8367a0576db7dd297
SHA512 1835dbf430a32797cc361e952fc77448e85b3206277f83cac99371dd463ce355596489c3fba77ad6d2a87b77c3a18531d7e1db7c2ed0d739902c87ef093c57a2
SSDEEP 12288:yVm22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D55523C11FEA84F6C47E9234C55150A1A275FDD8EFE362DF82450D8B0EF17E4A82974A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 ff36828fd6ea34ab8c9cc793662e10e9f7aaf1fe3f90a5b879af20dac85e899c
MD5 d7ae311b8f988c3cbb79238b2269d16a
SHA1 873c40189213529db4d834f4bd4edea71412b1a2
SHA512 16fff8e966a79f4269bd3000180f7f26aec9bf989ac302707d7d2f30f33c1ff3f7615f1eabed7e2f3fb2a9f24ea5cabd374cb2bc8441be1ef62d25b88afaf03e
SSDEEP 12288:7e22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:7e22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B45523C18FDEC9FAC03E5230465120E56529EEDDEEC7719B828D0D4B2AF1BB8944A54E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 d0c2eb30e8f52bb6361fc48a5ec8b1d98a8dfdc556c9b2281b31b1ea59b5ad19
MD5 071bd5893261ca41e1a1b6d090fd6399
SHA1 4d7e76a8dd3b214e875904c8b997b5f33c1618a9
SHA512 a97ea658fb41aee8bff189d91f78984f73f2513f7a1af7c521f4798ab4190a562f67b8e84b8622f0bfcb319f0a77939b261137041b152c39cdd3351551dad125
SSDEEP 12288:OL22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:OL22C9+bmOmbTk3reZCIT59z7m
TLSH
T1465523C18FDEC9FAC03E5230465120E56529EEDDEEC7619B428E0D4B2AF1FF8A44954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 d5f1c8898c3463e3b078d075d576cf86b5fc500a0f4e5fd1b33e84abdc30ba6c
MD5 6e1e0f2ad69cb96690f4187c635faad0
SHA1 6ef338d9b4e86ea9fdae72bc3746830ea7449922
SHA512 ecd5c1571f9d9f7c309267ea622f808479517cf79eff86e51ae5b436c411bf5dac707821d77792311e8110d0d5ac8409bc4d1b43c06c7bf30d849ecfec156ba3
SSDEEP 12288:rP22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:rP22C9+bmOmbTk3reZCIT59z7m
TLSH
T1325523C18FDEC9FAC13E4230464120F56529EEDDEEC7619B828E0D4B26F1BB8A40954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 78eecc2515d8d4b878d34e128f298f2ba8fe759164ff1ac745a6af6ce424793c
MD5 b27a2de44f7d8250bc818353ca5e97b1
SHA1 5bd24f7e4dd9a136a6447c160abac0ee4fdb7b08
SHA512 3869718d89f5975013c779f2936ec6ef87b821b1a9ea3fd05be37f5e4d23acd8c45785f18a2c0da3341f3a1b6895f47332964932bf1af6e9ce66484961984c01
SSDEEP 24576:eZMRzFVSO322C9+bmOmbTk3reZCIT59z7m:eZMRzf72LlOpbeZB7m
TLSH
T15C7502D5B39008F8DC7B813DC9518856D6B2BC594BA0C65F03E83A671F733A15C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 a028c3e0f70fd97785e5122a7f0746faa2f8bcddf7cadb3191ab18136eeda56f
MD5 1967c4e65f535353caf5dcbc53751ccf
SHA1 286934ab57815768fc7d42b3a42aea0ead658098
SHA512 acfab0620ac16772d5effafcbd21dd2e38792a31cddcb51d3cf7a306e7a2b4f8bee12edbf65bf82d68350caa53c8d254b6b4175d3103e3ecf35c5af08e6828ac
SSDEEP 12288:oA22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:oA22C9+bmOmbTk3reZCIT59z7m
TLSH
T1D15523C18FDEC8FAC17E1234465120E56529EEDDFEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 580b745382d1f0131f461590169c594adf2e1cce9df1afe58b744f9655e3175d
MD5 a3fc246ddd5fb45012076304b5f4a286
SHA1 350803e2649e84e3888233b15d86e140e4afb4ca
SHA512 d6d7194ae744eb4125e4a11e8dd3c98930856a0ad83374cc0fa6881ec65c8aa00cd7cf133c768ecf36714d3fcad3f513d3d0622cce3e4abf0f86e97168ff8e24
SSDEEP 12288:x822qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:x822C9+bmOmbTk3reZCIT59z7m
TLSH
T1B25523C18FDEC9FAC13E5230464120E56529EEDDFEC7719B828E0D4B2AF1BB8944954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 982a50a6ecfa5fe6813b46209728b42ed8f8c23075f23c3bb34397afc0d17ae3
MD5 bcb4600f483d55cd59dd3afefdc17556
SHA1 96939b35ae6fd42cfa4997489bcca4eed2421895
SHA512 15232e4f57713ee0ff13c2bbde8b1f93e574d2c1e087b6df886dabf8c5bf66cda9b740c3b8187f853d5aefcd41be62bd2f3caa83741d77aa7102e0497de906be
SSDEEP 12288:lyPz5L8T22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:szyT22C9+bmOmbTk3reZCIT59z7m
TLSH
T1B465128377A520F9C13B8234C9921951F376B8758B619AAF03940A772F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 a86b92e4602c4749774c3535ef50660f626f18a4d3de39fe2d6d27a7f1fe7dd0
MD5 1fa37cbed06fe566ccd1fd20eb75944f
SHA1 98782a03306197d1773912cda78dfd78aea57ba2
SHA512 54811714b594e9b4ad7a289fc6f606292d2e6d63c1b3969f3df3f9159d79d2ac42c0bb91921eeb94095872acad33f95590c6f84c2f216341d846e9ec96b2689a
SSDEEP 12288:WA22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:WA22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DC5523C14FDEC8FAC17E1234465120E56529EEDDEEC7719B828E0D4B2AF1BB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 f8ba7629cbeb768ff0ecb9e727191a40667a048485f20d870281220b5d6c92c4
MD5 9907e7d237f9a39366ed446eccf3fcc4
SHA1 a43b2242bb6f7b6bc56f8ff44427f3db021b9bc1
SHA512 53ecb1af77bc20804fa69d7cc770817cfa9d827924e529edcb06151de0de64fdebcb1ff408d22c1b1c45f6ad45c7137409dc782971e6b2d7a182dda5ad583588
SSDEEP 12288:DA22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:DA22C9+bmOmbTk3reZCIT59z7m
TLSH
T13E5523C18FDEC8FAC17E1234464120E56529EEDDEEC7719B828E0D4B2AF1FB8940954E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 b1c78638cf58469397b5f9f98c92f025c4115687ab89f6aa3743263292843c46
MD5 e6092e8de030b8f64f667c17e342557a
SHA1 adfda189208c0e12833af160ea45319c67fa1ef6
SHA512 191f5540218c93f729500232f5f0db60e0a450e95bf4f5ee7ad7338407e4ce36ad7f76eebc3f743ee2c060fae7136526a2828ea74c86e0b5acb4798505992c5f
SSDEEP 12288:KyPz5L8T22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:XzyT22C9+bmOmbTk3reZCIT59z7m
TLSH
T15065128377A520F9C13B8234C9921951F376B8758B619AAF03940A772F737E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 db2fe5067cb6c7019ae3e444215e3d8cc2b9914c52b32bec402be01b7f45c0e1
MD5 d691b221eff5f3725fe52bb10bc9f5f9
SHA1 2d3a7753f5fbb4f5f484b0ab289487ecd1abe1ed
SHA512 0b8b9ea47ceb10ec289d9724aec47f8512732be43427cd950838f3580e9b2a3f8a1feb453da6e8acdb499cecbced407e652893f49a940cd1159ad244f2433b03
SSDEEP 24576:zcP4mcvIjkGOxhKP2l71SNKbrh/8KBY22C9+bmOmbTk3reZCIT59z7m:IP4m4IpOO67N8Ka2LlOpbeZB7m
TLSH
T10965AE2DABDC0096D0BB913885658A49FAB1B42E1F3286CB1160933D3F77EE54E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b77b9fa12c67e27bf769625cbb63725303c8640f1401a40b20d6802562745f3f
MD5 77ba7f12505681577082f7241e6dbe51
SHA1 516b3ee22956e713a555cffb6acef3f93bd676fb
SHA512 688efb359b037a60814738ad0b33a30e669bec423d99d3491791ff80807a37ed87aa4e22e31ce50b21f34aefb407d6e503480d7fed579c9eb899cadc227911f0
SSDEEP 12288:lbsfQ22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:AQ22C9+bmOmbTk3reZCIT59z7m
TLSH
T10865F185D79842E8C06E6234C7515641B333BC659BE2E3CB52C0F97E1FB66A09DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 49202c5dd7aee5b97dcb3ba5c14bf6db4824ac55a2aa32d398e4711467da44a1
MD5 0496287481c116793a1c024995bc73ab
SHA1 afb6c07ec862e7a12cad8676ff75698d1ef0a300
SHA512 f13f3de17ae0f22bfb74e1767d4ea4b43aab9d968cfdbc87d6a97e9f7389e24e5d9f9a165f00c341bb9aed4e17cd411ea8f95a3ee12acdebdbd84874f152ec04
SSDEEP 12288:zw22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:zw22C9+bmOmbTk3reZCIT59z7m
TLSH
T13B5523C28FDDC9FAC17E5230455190B4712EFEA8DFD6A18B91490E8B19F1EF4D81A60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 56b52a76d2b0ee6a49221f4157bf6631fc3e4a0e50a4d4e7485f8f0daf7241ee
MD5 418d224fdc985094fe9f77c0637a2c66
SHA1 f51d24177e9ad90b883cc07e8e3272736e5498d0
SHA512 72179e9563943230f1e0f96d32049388365b0e1098c88e81d77bbc40d40dd3302cfb3f0e69137de43e8a0f912b9f2d27202bff3ca940d7dae6dd23df0efac552
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQe2LlOpbeZB7m:ra0hNYG4Jwbycv
TLSH
T14C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 f4f8d5e53f9e4904660c02df9b8245c258fad3c4c2754378b65881222c357b34
MD5 9e2564caab491af7ac6ececdfd453761
SHA1 12453076db6882a09b0f032b0ed56253802c37da
SHA512 a5aa139c9a9a370754865c9ef756bcf796231155f7c274db2255a01f235b92fec71eff7dbc3d52a080246c3e7a1bbe596d223a3a96ea3ca5f7e238a32ae862aa
SSDEEP 12288:whbHjfXn22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:whbHjPn22C9+bmOmbTk3reZCIT59z7m
TLSH
T1936512AE1BEC10E9E17AA23C85914146D331FC695B52A3EF12C5827E0F77EE45C39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1a2b9b9dcf10b8c4d05a16b2991859135c0094045c66eeac8520a6b9218356d1
MD5 b44ac47aec849158791850fb0a10bff5
SHA1 692abab8ec38d5a2bcc62f8b4e88a26f227dd928
SHA512 3be4f1fb14ac878a052c4b2684a6026afa6fe31ef2d26b7e5533243d61561e1833ea819974f8e2f2b3d2a2b7f8b57847e7a8a61f66a0431a92b2f23d5b6306b2
SSDEEP 24576:X3YgnJcRTk4yti+R5dpR//22C9+bmOmbTk3reZCIT59z7m:XIgnaTk46ppR//2LlOpbeZB7m
TLSH
T11145BF2DF3B910F9C8AAD136450147B5BB71782D1F209ACB0174C538AF16EE89E39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 a4930e8220c162181f2d298ea880d309de4648477214c50f5acb76b04ed52bbf
MD5 0f2b941d46f154a9f515c520783f0c8d
SHA1 919219f10aad689c3ce07bf3bf445d63f0f48861
SHA512 71566b08461e82e29b850fdc578c071a1582d894846a965dd50ad30f0d04a519c102837512c06b0c8397dc95bbcfa80ed826e58ecea40ec8704454b472acf147
SSDEEP 12288:ks22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:ks22C9+bmOmbTk3reZCIT59z7m
TLSH
T10F5523C14FDDC8FAC07E5234464160B56129EE98EFD761DB418D0D8B2AF1FF9A43924A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ec4eb759ef51f923841b6101904c6400d0a839097223e843a89ed4f3c20ab6c2
MD5 e646444b18d54168e1a6e924240ce4ae
SHA1 0b0743df32877222a2cade25b774dfa1b22bba1c
SHA512 ac378f98684b7d530ec63c443a76b78ec09a658acfb4c3f3601f73b362aec851cc8600bf482ba4f3ea37a1567c5fc89b754d7a797e8ebfb4dcd5b2fbe0744a4e
SSDEEP 12288:aObfA4LWOsvAYFTl22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxp7:LbL3UTl22C9+bmOmbTk3reZCIT59z7m
TLSH
T1DB850155EBE400F9D87B813CC9A28516E272B89D07A4E7DF03A84E561F637E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ea2e880ec1621eb0a8a250b0f1e8407eed28ad9cf2fab9ac519de4e5050d7f8b
MD5 57dd2e4c063e148b2b0d01fc36f4b472
SHA1 c7c21d3c6fb83cf657175735d110c1307556d2f1
SHA512 eecda0195282256838bd00ad322477780d3f4e2a9c010583c68aba31a90ead982f199dfc027561808228716eb60b3bde9ffcb929af3624303139debdf491d8cc
SSDEEP 12288:0pFtIOx22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:vOx22C9+bmOmbTk3reZCIT59z7m
TLSH
T1646502552BED10F5D07AA13C8A924249D371F8654B5263DF02D085AE1FB3FF8AC3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60bd5bf68b6ef848266ae30ebe4d6480c5753efb30eb13a79865376cbbb3d6bb
MD5 18ad38e2c417ec09405ab46c73751b8d
SHA1 defb3cd5c2aef909d94a7c8c1bd6088d0dbeb98c
SHA512 56bad4e98d348c09df79dc519c4646f5b4a79d848601035d2edcbf824d118ef4f9717df96753038523bff63c3ff37543484ed08d982c2e75cab7befa9ad26b02
SSDEEP 24576:A7NM9YmZqmWMUkPjZM48Mv6bEhsA22C9+bmOmbTk3reZCIT59z7m:A7cBWMpPjN8DbEhH2LlOpbeZB7m
TLSH
T124659E6E6BEC81E5D477D13DC9A28205F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0bd85b7641be90252bcac329d67d46543f38e0d9f18c983839aba498c51e05c1
MD5 52165674a318f4329aa71fbe1dd24823
SHA1 61a332d28265f434db7087080e356559e8625c0a
SHA512 7b44cf3e847669029bf331dbf9761682a9df0ef3dd869a23ddb97b1cd33defb6b016d322eeb438893eaf970304c0daace87b9f0585f2046548fb7fba6b05536a
SSDEEP 24576:hW6BApg2YuyuNDYTabvcRvNYf8km1C22C9+bmOmbTk3reZCIT59z7m:hF2YuHNETovcvNYf8kmg2LlOpbeZB7m
TLSH
T106858E6927ED80E4E0BBD27D45B6D186FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 64894c2b4ccd05d65b3046a19c81ce8804f6cd155d0979d57b9befec8c249389
MD5 c74e88b016daabda52b988c4e459d4df
SHA1 5c51b415ee261ad528c848bdd95791c9f9662aa3
SHA512 4152c921e53f10bea8e0e95324640c5aec5dc84521acf21fce9686f4d4284d5c18e98de81c055af77cde86019abe820250909925c38866e0e9c7ac0cfa9bea16
SSDEEP 24576:LAFs06+OmlfkNXEbToN22C9+bmOmbTk3reZCIT59z7m:EFs060lwXu+2LlOpbeZB7m
TLSH
T10765AF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E3F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 cff72b593ba317c17c0158e4d7f6bebe5b8c634be5dce6cad519df49f3cc2daa
MD5 588aa3030f2bd900dff02c45b0d0816b
SHA1 c72b83c92d77d107e3e118973087475de8ffc65b
SHA512 a7164ce60ba7c683c7e3811aa6dfee228d30fddbfad59e0825f328524811c0f96f8c876f371bb41bd913e3ca7fa37dd9201d3d60705274f5b2646ddccafc2ab8
SSDEEP 24576:SJnJ5D3Wt+22C9+bmOmbTk3reZCIT59z7m:SJnJ5DGt+2LlOpbeZB7m
TLSH
T16875D06DD2A810F8D4BBC274815A1696FE72387D2F2269CB14B4D5353F22FE09979F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c6f9909fd9c8e6ec2a14a151e968cf70f57e9baa90e735ba9bd347d8ed17004d
MD5 f247111e2f5904d0b8842642fbaee1d5
SHA1 fc04a8e57ef425db51c110df83b3a114fc81ced4
SHA512 66ad311f933d53c52208658c8f7a5139bf05c661849127a7fefac91d0820d6ca8ee8847abbee98cd4a1a833c7ea47b0b3d35adbea3399dbeaabe973f164a9758
SSDEEP 49152:lo06DIKdwc+eQnSt65aVU2LlOpbeZB7m:yiycv
TLSH
T1F3956D15BBEA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 226e897099f448ee19ca630f7987bde5ff9578b51063fc11c4c3e91143018e3c
MD5 e90b2c0541e1c22c92b130c4af714858
SHA1 cd9a924a54b3c79a6398e70e0e8838fba4cff9d4
SHA512 b2bd29f56691db8aaef97e978fc873704611ce4593870c3d7a5ee2d6d3fd33e13e4de2e2689e97804f4a84fd2efff93b3df61157ebbe8c9bf975151e49e53561
SSDEEP 12288:EEP3RrK22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:/rK22C9+bmOmbTk3reZCIT59z7m
TLSH
T15665029D2B9DA0F9C03E913C85918145D372F474AF9223EF42D5867E0EB3AF96D39A01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 5ad7843a052141ecea48de55577c974f5fc992537903b5db0502728accf9abeb
MD5 49980dfda66cfda7128093fc395d362f
SHA1 8b191eaa0bbbfbac79a02b6cbbf381ab4f5ab5b0
SHA512 17d2683faf9e812f36acc42f1c0f1f28603671bb2707af60621c0e8ea831c86efb343c203752f03c29bf081670b0d44464869f40c4d892c57cc029adb0249853
SSDEEP 12288:ljkyX22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:lIyX22C9+bmOmbTk3reZCIT59z7m
TLSH
T19465128057D894E5D5BE42388A6341E49A35FC709F6263DF51C0AA3F2F72BE4AC35B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 bccb015911a553cc6dd8d1831ae73d1014c5d137a131ab9bfb60c542cd0e8717
MD5 d8baf4924de438c5ada06bdb3b446247
SHA1 42c6d6b9a7e2d0685f36fb728493165420900128
SHA512 ddbb330ded044889dc7c1c7df959198a9135b90855d0f8ecdde3235cdb041c770731619d82c50bfb2a7c1c62a074878535b437db3b53df8075a4f9de7401e04e
SSDEEP 12288:DFh22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Rh22C9+bmOmbTk3reZCIT59z7m
TLSH
T1915523C44FEA94FAC53E5234425154E16135FDB8EFD231EF40C98D7B1AF2AE4A03A94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f74611572768ec6e4ed41fe9f2e52e36fd89a13db0f819f71f158b75559ea7d8
MD5 ac72e85ed82d59b8bb602c0b8d95452a
SHA1 4adddc42b11c927a14808a1aa1576169e898e7c2
SHA512 4e7af1e7d2c1d8056a188badcb0be993e0b28a1d478d932df726667a5791df846cb5dbdfc5fe2d27174dd69e066dc678b02152f7c74259d95764c8b3d8ff8a5b
SSDEEP 24576:+Q9MxZKdcz97w3o22C9+bmOmbTk3reZCIT59z7m:+VKXo2LlOpbeZB7m
TLSH
T1F2557C2DABE905DAE177D23595A250C3A633B4311B31D6CF2448D03D4DBAEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 53c8faf2764cf18b0fab4f69ee4fd39b0bd0b03e3300690df416a757bb77189d
MD5 f98f4d207c6f4a07a0bf504a5d0dcbe5
SHA1 68cf99f55105d7166a76099e38f4e6a39ac82eea
SHA512 154163d9d01d8a00fb8fbf4bd80dbc9ea28ceed6de3abab3ed5f584e38a48b835a4a1310c21bd4e2259899b4d0ea6039cabadcf1744cbcba308a091dbf495fb0
SSDEEP 24576:tyocxApj22C9+bmOmbTk3reZCIT59z7m:wocxApj2LlOpbeZB7m
TLSH
T1B675E05FBBAD40E2D07A813C89818245E773B4745B6263CB5191C73E4E73AE9BD38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0e9568931236bcc9e873ae275a011e6816be28360df834fe7e5df21be4e5b3d4
MD5 d6a6868c488f1b5f202a27882155bc35
SHA1 69d374ccb05fbc4cfa4443e4cf70d0acf56677d1
SHA512 9898b890fcaeccdebda65985294770eacbcda5c369e3388f4edd58c2aab88b09d14da6d30e35280aa05e19b3a227ad2d27ff306d6fd9e6ba2537faf053e626ae
SSDEEP 49152:CWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKj2LlOpbeZB7m:00zuNIvycv
TLSH
T158A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e21f83b578267bd246521146b9c68cc20611dbd57bc4c10c282e2263d513e84c
MD5 d5a80405dd753cac7411c2503d580a29
SHA1 62d79a02ebd1821f181c1432bcf2baca3331eae1
SHA512 a2029da1e9767829fb0c525382d120ef95926744f916eb8a330d99ef061148343d4284e9a04094847ddf960d7ff8ea65c621dd2d3c1228c39d666ac737255d8f
SSDEEP 24576:Z1QT7EcpfxR+N5AWAz3ooiYujMqbK22C9+bmOmbTk3reZCIT59z7m:MTDxR+N5YzT4jMR2LlOpbeZB7m
TLSH
T18A55B02EA7F845E9D1BE85788A23C512FA727821073193CF42A0C17E1E779D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 a01035dcf15a2fed0623063a14d2291347b76adce14b2ce362e56efe221c0d8c
MD5 54a71a58134b95ff2d43cd276ae26c22
SHA1 2d0973f14e8fec95c2a3050dfbd12382b6a2283d
SHA512 98573e7af311626863ce190147481d8f6561902da8aa1890c7faaab691dad3afe6c8a2e3a9c81fbfbfada5610a43c7e829aef94872c5358415e0acd8c8a200e2
SSDEEP 24576:2TMdOz0FFS+bmSLm22C9+bmOmbTk3reZCIT59z7m:S0K+bmSLm2LlOpbeZB7m
TLSH
T13B75F17EA7AD04F5E47FC27C96438906E6727465032266DB02D0C1BA2FA7FE47939B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 793e1abc0feb1a2f5e91035c9c4367e4a5a31fa90389b296acb4cf44661d80f1
MD5 df276ca244366ab053a0c16de796b4bf
SHA1 7038334216635d36f592b215cb72e455bdd7acc1
SHA512 abd7ed78faeb8f9de226636280d5d55846d8c22aaa1cc7c364c7bcd167562b8b8953e8d5c15771638b1131a6c3147ad33ebf15c036ca3091daf5200e78a9bbf2
SSDEEP 12288:547l22qH9+bB0OmH7TkKhar9E5pZCX4FlRzgRwCY4+11iLy7mxpIzG:Ml22C9+bmOmbTk3reZCIT59z7m
TLSH
T1A66512891BEC64F9D47A9234866201959230FC796BA662FF21D4CD7F0F72AE4D439B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-180-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/436-352-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/436-174-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/620-11-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/620-372-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/620-21-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/620-20-0x0000000140000000-0x000000014022B000-memory.dmp

Download

memory/1080-346-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1080-122-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1080-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1208-217-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1208-355-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1208-223-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1220-143-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1220-349-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/1220-149-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/1372-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1372-54-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1372-48-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1372-494-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2032-401-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/2032-25-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2032-33-0x0000000140000000-0x000000014022A000-memory.dmp

Download

memory/2032-34-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/2272-197-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2272-203-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2272-353-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2420-207-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2420-213-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2420-354-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2436-153-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2436-350-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2436-159-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2480-0-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/2480-331-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/2480-1-0x0000000000150000-0x00000000001B7000-memory.dmp

Download

memory/2480-6-0x0000000000150000-0x00000000001B7000-memory.dmp

Download

memory/2480-493-0x0000000000400000-0x0000000000FAA000-memory.dmp

Download

memory/2692-81-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2692-84-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2692-38-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2692-44-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2692-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2816-233-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2816-356-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/2816-495-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/2916-339-0x0000000140000000-0x0000000140250000-memory.dmp

Download

memory/2916-97-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2916-103-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/2928-170-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2928-164-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/2928-351-0x0000000140000000-0x0000000140283000-memory.dmp

Download

memory/3132-511-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-505-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-503-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-497-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-500-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-507-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-508-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-509-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-510-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-498-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-499-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-504-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-506-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-502-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3132-501-0x0000024EBA7D0000-0x0000024EBA7E0000-memory.dmp

Download

memory/3304-113-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3304-107-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3304-340-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3496-195-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3496-193-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3496-184-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3496-190-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3832-92-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3832-358-0x0000000140000000-0x000000014023A000-memory.dmp

Download

memory/3832-86-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/3988-438-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3988-138-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3988-132-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/3988-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3988-436-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4428-491-0x000000000BDD0000-0x000000000BDD8000-memory.dmp

Download

memory/4428-269-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/4428-357-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4428-317-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/4428-244-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4428-238-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4428-285-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/4428-496-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4656-344-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4688-75-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4688-69-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4688-79-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/4688-83-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/5032-342-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5032-65-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5032-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download