c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Size 4.6MB
Sample261002-t3fsbaec66
SHA256 c58ce45e95d5cda7ddc0c5b823ea78491a4e6738e7e4e5bf58d230a257455530
MD5 39afd6febb7eeb70b5728fd5d86506b4
SHA1 618b8b214bc64f8d5d92954867c767c95e1697a6
SHA512 b6a662de1debcaf682bdee7bb08c83a95a9d7857abcae209aceca5ce0df679da9498111f80325e7dd04d5f3c893bace255947281d9b34bf23a2f3d0e3b274404
SSDEEP 98304:EC0Uq/np6a7nwvXlUvUF4hGFoLAPdc5MUAE:lq/nAo443GSLW6MUA
TLSH
T18636D012FBC281B1E5930174556ABB3F8D3DBA34672489C7ABC01D2D8C316D16A3A79F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
432	alg.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
216	elevation_service.exe
3620	elevation_service.exe
2696	maintenanceservice.exe
2748	OSE.EXE
4372	fxssvc.exe
4224	msdtc.exe
3940	PerceptionSimulationService.exe
3840	perfhost.exe
1852	locator.exe
820	SensorDataService.exe
3504	snmptrap.exe
1892	spectrum.exe
1664	ssh-agent.exe
1196	TieringEngineService.exe
4972	AgentService.exe
964	vds.exe
4912	vssvc.exe
2612	wbengine.exe
4812	WmiApSrv.exe
4168	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42d39e7360f3a3fa.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adf83e2f8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006821462f8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e703ed2f8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099dcaa318c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000843f07308c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d6d732f8c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012e2882f8c52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1cad22f8c52dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4832	DiagnosticsHub.StandardCollector.Service.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
4832	DiagnosticsHub.StandardCollector.Service.exe
216	elevation_service.exe
216	elevation_service.exe
216	elevation_service.exe
216	elevation_service.exe
216	elevation_service.exe
216	elevation_service.exe
216	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2948	2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
Token: SeDebugPrivilege	4832	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	216	elevation_service.exe
Token: SeAuditPrivilege	4372	fxssvc.exe
Token: SeRestorePrivilege	1196	TieringEngineService.exe
Token: SeManageVolumePrivilege	1196	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4972	AgentService.exe
Token: SeBackupPrivilege	4912	vssvc.exe
Token: SeRestorePrivilege	4912	vssvc.exe
Token: SeAuditPrivilege	4912	vssvc.exe
Token: SeBackupPrivilege	2612	wbengine.exe
Token: SeRestorePrivilege	2612	wbengine.exe
Token: SeSecurityPrivilege	2612	wbengine.exe
Token: 33	4168	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4168	SearchIndexer.exe
Token: SeDebugPrivilege	216	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4772	4168	SearchIndexer.exe	133
PID 4168 wrote to memory of 512	4168	SearchIndexer.exe	134

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_39afd6febb7eeb70b5728fd5d86506b4_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_ly.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:432

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3620

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2636

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4224

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3504

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4812

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4772
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 31e137557243c692c554b70cb3b6f47aa78072ce452784bbfad9b834e0018c15
MD5 c6ff90a261a466c272214bf72a44b4f9
SHA1 8744c4be3f6cbee5a0e3f3b1305f5ff888c44b61
SHA512 6e4e29b33085c98300980cfc09a0cd7ad73a047c1ff863bffba86a9e4328db658ca8a649144eff5df29739940e75b0cf3470d22fe21079999f2123569f66e5ab
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9At6+dc0gQfM956TQ:V3q6HjBiAPdc5MUAE
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.3MB
SHA256 d90a0cc70ffd8daf3c3a897c0f3aa45719374c660a03c87c986887c79f6514bf
MD5 98d3d29271253b2f66b28920901256e4
SHA1 ea45379d2815680783a98133d050105b5ccdd73f
SHA512 a37be495b072a1c0e69be722dc97da9ee2cbc38bdc26924d73e87f740a38efa7f23525fba1cd43d70bbf7e851f0b886445468ba79376fd5cb92a44a109a6686f
SSDEEP 24576:KXYfDtczA+Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:Rtc/At6+dc0gQfM956TQ
TLSH
T1A555F12473D508F9ED6B813CC9B2C501E673B8554760EB8B03A49A7A4F237D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 4cf71a5b937829e829aadc36a563e5ce167094e03487de4eac4d8f2babcc8406
MD5 7afab2a1d6d48ff8460eaf8ab3cc061b
SHA1 5c35f3bf2140eec3c4353f49bc784a2badff57cc
SHA512 ac3616096e9df6deecaa93662a1c6fc494703b2f9e364cb21e098485fc9b721d888f949f451b8c4a4d99e43b75736941110c621a4f96132e011b42f5c45b16f6
SSDEEP 24576:a0Le5ji0hmxKrMVAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:aPji0A00At6+dc0gQfM956TQ
TLSH
T17275AE16F6748735D073C0B9C5D2A68AE97230861B308ACB4286D77C7F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a37077377987be37d5ef881bc50f809960f46f6e0db84142d5263a2f1b1ac7fa
MD5 94d3c4fecf2673fe5918c95a73c315b3
SHA1 804592647241dec2e903f503e4b44263368bacd8
SHA512 34315a1f4aeb73cdafb5be502f49eac99842dad2ab070be9338cddf767f1d98a3825eee625d05e5f23613b43612afc8e5d7e0a43f9e42d969064dbb69b3355d7
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuvAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:W/ezSC6vUzPvxHjyAAt6+dc0gQfM956E
TLSH
T18C756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ff0ac745ff5e0727861b8ffa265e16d3722203aa7752b1e1e99fcbc24be0cba
MD5 6a13670ced1b3085874c8a9b0700cce6
SHA1 9e8e5b9273ad8a386c710e64194d26612b11bf78
SHA512 23348fe7555617b7091fda9791e19312243f264d7cb0dfb5777a92a4665ff9f9c2de6189d768b3315cfbcc6bb274ffc56a17c27a6bbd1923e2b106f6f5ac1ad8
SSDEEP 24576:0VbqPb88hv/l+6SAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:0VO88hXl+xAt6+dc0gQfM956TQ
TLSH
T13F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2F67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 7753c0c67e4500a1385f4c5cfbdf902135e5366573108251718069d880c69e0d
MD5 ee942c3cca402c2dec0ade5a4d135158
SHA1 19527ddffbae03dd1163fdbf5892276ee15f39f9
SHA512 3a78cc7c29faf289479a50efd767c0fdf7a739c609f5316dac2bd81ec5e498cd946299d5b77de0d4aed8761e429b12200697468d150f7a082680e5718d76c58c
SSDEEP 24576:lJ5Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ6:dAt6+dc0gQfM956TQ
TLSH
T1DE352392538A9CDAEB5B0839D67DC65080B69C0C5C214916D061FEBECB37AD58EE270B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.3MB
SHA256 4637e9a28766b4a36738b2481fb4f4c544c697f52b48f25c76301ce9d01161c7
MD5 df8e875532147dc0bdd795e14ae87eb7
SHA1 a2e68275f10ed39650ae8e4db4f5c048d48abfc6
SHA512 6c4fa4d53edce351eaa54a469798395ad045d42d6baa7f0c7788140dfe24aa094b6c59d792730b62bc32219376fea0dc4b4da1f3766e6d39c1048f517458d1d7
SSDEEP 24576:OJIUqAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:OJIUqAt6+dc0gQfM956TQ
TLSH
T18555CF7BAE28FCE2C67A4D785AA1C600D77278304F6293CBD165C20EDE235E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6c9fc9389ea338b65eb6f73d3c4b75e483cac80cf1a4dfc8c55c3247c3ab3897
MD5 d10a05fde64e34be2b8cb8ee8f675c18
SHA1 1ac546dd1c706ecfc0d47fcfe7ab5a5608585bf7
SHA512 b9512a559289115fc323c6fd9327a8624b6dcf64f04044c433b2d7b2e96f27c9ab07022ce7460d88384ceade05d422a891dd66f29bb489c6b3f2783c668fb2f2
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:EQvGAdlCEL8c/yRNw5CfAPdc5MUAE
TLSH
T1A2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 c050c0f7d9888bc938d492ec1d3edc57c12f5b35354fff6d6d4349cb1f6bcb14
MD5 07ed42cb83489c12438f6d2115479931
SHA1 b635611aeeed4845c74e3353c9bb964179dbcbf3
SHA512 b3cbed4b3f69b51a8b2685a34d7ba0b0b67632de6fb18a0a2a0de81e46809aeefa6e95130e8a43719c724568dd7479310241ca7a4dc5f6f23e26bda595812a52
SSDEEP 24576:BVewsAjkAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZp:XljkAt6+dc0gQfM956TQ
TLSH
T16F65E031FA75E436C77B0DB61B35C716147DB9204F611AC3E3A88E9E8A302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ced52457d65cabb7a9dc6bd32ee78f5a8f9e9bb45913e020659e80896dfd5d47
MD5 f08f8e91fdb880d142c0cc37a9abb1a3
SHA1 bef589206591893aa0912f542bc9401121fdf534
SHA512 590374dbbe2996f115838a77e146a89dcb8f3dbba81adedb7df5e7922e8c867c5ba86041825b5d6d57cf5fa525b3d84b658cc2b9aa84b6815c64526215833ced
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHMW6MUA:rUEtQevvqc2W1cpV2EI32OM
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e894b8685c2a1f474f8bff0e59b7bba94c15488563bc5b2d958c539399ace55c
MD5 0b10c91a56fb02de51c571bc7c60ae23
SHA1 1ded70d8995becc3dbc22975adff67a8cec9242a
SHA512 585746a6f21b7b0b0645247d2ab0cecdabf29a4920263d6c9884b7b0b30eff6299fb7822f8a078f31115bde60198ba423d87bb3a9e9b5dc9d21e7be5cd7b1922
SSDEEP 49152:OCbRquA/m2yL5zQfFiV+XenmE3/zEAt6+dc0gQfM956TQ:joqtVjnmLAPdc5MUAE
TLSH
T1AFD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 890105eda67a0f372a1b4b69363d32381d7833f42696ff467a1f3617776519fb
MD5 2b0a8ea1a24076dbb71525827ba76704
SHA1 08d16cd1f8555a857c3d8bfa3eeb3a52d4ab477e
SHA512 c9a80e06e8652dffb05ea975a42e6e2c9ebc4ccac55ea50469b1990bdadad842075a40fd199253a83c2be6fbd336550aa1d890be8b9c68b89232b28b99378883
SSDEEP 24576:wAhGLJIFoiwtA5l7S53rAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:wAMyFoiq57At6+dc0gQfM956TQ
TLSH
T17D35AE81E7F955D4F5B3AA7899B68171EA76BCAA5E31C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 15bd0d6458897d5533d486dcdf7ec9aa8faf3a5089710c5dd5912d1475f4c579
MD5 8b1c6d73bcd21be3503dfb39958834a4
SHA1 c947d188efd14975cbc5135cf5eeff9eb25183a2
SHA512 845814be52246fbb7dd2dc78d5fe77885a74f3c155e5207c65ad4f105e204783e379e02378e820b9231dc7759623497069e065872272abb48bb0a2c9e3080fc3
SSDEEP 24576:pwugOWgAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:pwLOHAt6+dc0gQfM956TQ
TLSH
T1BB55F14673990CF9E9674539C567C132E7F2BC052A21CB1F5760C66B9F33361AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.1MB
SHA256 c9be711acfd40bda9807c27179adfcb785b1d1bbac293538f6745074da7b9e7a
MD5 18eea7b7d9e1c72adf14c9d35850a1a3
SHA1 eeba5ddf6883f8962786c5e9500db75e77a4ab90
SHA512 fb0c6c6e75a193894076a8e6c0291d014ca1aeaa6f6fb72ae114df4a550c856c63c8b7e6678f23b7cbe17da6dd621fa3dbee6c96c92f26ea45bf32103e777d3f
SSDEEP 24576:rZutAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:wAt6+dc0gQfM956TQ
TLSH
T1D545129633C964FAE667453CC9F9C601D3B278162B3243CF516486AE9F33AC54E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 35a9dbb27df7ce1442158438aea45c0b717affab1380c26dabe13ef146534290
MD5 2edb41a72ad9397f535b3795e0f75835
SHA1 76aa52394c227a5f6a585ce5c790a844737fc048
SHA512 eba4b0d19960f82f7ae6dd93b4ec3e06cae677e3465a024814e940ea2529e4099db8a0855327de68c15bbdb8e337b407f74aef8338ec8f1d9f7af97d860245c8
SSDEEP 98304:lQRQyi36YOcPQLvw2gAf+PN32APdc5MUAE:cQyiKayX+PNGW6MUA
TLSH
T1AB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 200792fb899593808f3955148961053238f477eb7a7b96e904687dddb4560b8f
MD5 c977894744e6db173fff70fa5f21e69c
SHA1 fa7d5d1464e99b67403c73a50ce25f79bc4be2e5
SHA512 4d745ed3667917ebc9a50395b499f82c612df50f77a64b2a3f21b14542c11822a5d98f2996d0de1405992fbab35293fbb8a7956f51808fd9055231a7dcb3184e
SSDEEP 98304:ZQRQyi36YOcPQLvw2gAf+PN32APdc5MUAE:QQyiKayX+PNGW6MUA
TLSH
T1EA667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 93029e5c5f608d012989678c175ce5546818425833433b27a9676e36a97c4224
MD5 e33867afd8f0aad6bec3c7d43be814b4
SHA1 e3817c96d6d15102e2e94a896e1efb412bec9749
SHA512 a391c073e8ef386623cafc10fb6b34d865371960099a0d24bd8110c06afb140ffb93f46dcb61d97387df734f506cd0ce83f43a43fdfef0dacad0158863801300
SSDEEP 49152:R68Qg55nhheWu7PNU3/0At6+dc0gQfM956TQ:PthWRc/0APdc5MUAE
TLSH
T138B55A33B2F600A9C44DD1769F4A872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6e19594aa676b22c169248dbccf5d181d986b19a5aedf8f18b96ea79e4420a6f
MD5 c6e3e2b07c5eda6362251f6c7d47ee53
SHA1 5c03fb047393ef3e89be1e0f4662d8908977826f
SHA512 54742e7f6582f2f772dde7a550ff53be91be74ad254f0097ed3b5acde07980349254d32d13783f2e5091a8cd2305e57289878eae9cf98e7d344d00b73b6c8a10
SSDEEP 98304:Uy5112gYy5azzVvL69nLKnhZ5APdc5MUAE:VLIHmWhzW6MUA
TLSH
T1BD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 06b7069bdd9fb1fa3760b7c09ec84811f6864f8ca056dcd3e9a9211389015fee
MD5 13c24bdcc4c622dd953abf4481e1a6e3
SHA1 04b915ce72ca9552f839aed9d7a170a47961e627
SHA512 f5e1d87ed78e40f0a8703a6a3378c938c26db41e49f6acdc41ec64aa266b8e29c4f22418ca9e0b927e906bcf58f7a26ab4403986f0ac8b9ad05a3651c9348c57
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOAt6+dc0gQfM956TQ:Uu6JmVxd2dOAPdc5MUAE
TLSH
T137D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ff189374612712a63fc01f40efe7bb3b6c0e733e97c161d187fa6f51ecee968f
MD5 93900d1f504f6064555d7981b537b18f
SHA1 666badf6402dd882ee10689650fa15bc31ea0402
SHA512 fdcf0488d213fec6962f3532b4df3307e9873c4decae751ab38e7b4a2ba7872f6decdd3c3b7863e181220193e8d33b8e9d354a1aaa6ace2fb96be917827cc44f
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xKAt6+dc0gQfM956TQ:emifPbRLAPdc5MUAE
TLSH
T10AB5BE13F2D900E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4d060281f370bc683a211d33cf274b79cea5088114d8030c4273dd91b89cbaa9
MD5 c6230b3a97ec8385327e806987b50b16
SHA1 15d3b3f275d4f0af26431bc35ce93d60f7cb027a
SHA512 2b9a2592c6708205e34d483bc156978645e5a574cc168770de5ea5f7d2490d2765886a9d33d49ec489c58163759627a1fc9add9e7009ffa8a0a6ba7da29b2c4e
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqtAt6+dc0gQfM956TQ:Y5dKTi61tAPdc5MUAE
TLSH
T1EDC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c8ae0b116ddb70dd5f54b3f53a2279d12b7a40394c8d8ed1a6f5ca60eabc0206
MD5 33cd5cfbec60ca707a4ac942b9c888c5
SHA1 b5cc78e77ebea0904d8573382c7eb4a3bc212763
SHA512 bf7ff3f0d84237a2a82767f48249b14c4d910cdedfa46f342377d217d3c8fd429a1fa003a286a7a84d1d00ea9d96dbe8fc2bd8188b455beb245eef3560160cc4
SSDEEP 49152:bhtSn8EApI0figngiDn0AP5w+At6+dc0gQfM956TQ:6X2iyphnAPdc5MUAE
TLSH
T1B395BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 f53dd8f6055f0225890b0c0d6bcee8fb8d4a7310e73c9f3ea244a0a88888cd7e
MD5 3c8b3c7158de1f5e701673a04b3e26df
SHA1 31256d1563756edbd26457cfec738ea8e70f6a40
SHA512 c1652d7eeee630a329027bef2d7d2cd06d35877f9bc21800bb2986da0bc46fea451bfdd14273ec79dbd0a529f0d79b8deb02a36fcfe258eb1c43e00ee0901d50
SSDEEP 24576:SxAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:CAt6+dc0gQfM956TQ
TLSH
T172352391628F8CDFEA0B0979C67DC240C0B66C0EBD220556E555D97FCB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 fb09b9822a4fd6aa5b34f15cfb04f42a3565ba4b4b312207e652721db345fefb
MD5 42d434173767ca0e3c59f14f24de6c1b
SHA1 b5d1f2084499dcaf244c20343640cbadd8878722
SHA512 ef31a6d2db84290f8973431b0e3401d1c1edb9bda62e3cdf4cd684c30a99cb9ed88a13740fe41a70c19e40b25ec65d337e206734a61fbf641d2fc13472328c82
SSDEEP 24576:GoAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:XAt6+dc0gQfM956TQ
TLSH
T1FC352391618F8CDFEA0B0879C67DC240C0B66C0EBD224556E555D97FCB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 db82fcb0b2832cbf0d01c85da04d0bfc22321366e86e75ba9cbd0afec4207fa1
MD5 26fad9a38be5b2053d6696cf8da321da
SHA1 725e85a5718c9a4c022b74a1aacf7a673cb8f822
SHA512 8416c2408b7c603237267f4e08da817e14c85bb200c29fd1f43f184608ac645b1f32cb2a8652be7c8ec8ecbd75e2b7b3a3d533e3b6822b2fa251e30dc0a2870b
SSDEEP 24576:LiAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:GAt6+dc0gQfM956TQ
TLSH
T1B4352391628F8CDFEA0B0879C67DC340C4B6680EBD220556E555D97ECB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 c989998ad3e0b3ada5c42cf630abe006a3893149e4401af8b0f6e0f43147d137
MD5 a47d254daeba0c4bb5d9270719e854c8
SHA1 270b4631127d7142de8fc4a404e8f97543725ace
SHA512 e6e8b31ea474acf19c37abcd11f5faf017f50008eb774fae21d05bd4fcc995ed9f4dfc032c9a890030bcc6c2b653f95a091e8a607775f96beb14233183b9bd9a
SSDEEP 24576:rAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:rAt6+dc0gQfM956TQ
TLSH
T1DC352352238F48DAD9178938CA79C240D1B6BC4DAE32465FD610496ECF33BD45EB1F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 30aeb565f293088d7d3a6032140b2c117db69fd17964a9c39085d99182d55734
MD5 556af2ca2c6e6b3f7b7830984aea0375
SHA1 55bdc2671a4b8934fd08b4c9f0bc747939ac4ee4
SHA512 e3fff09f195c13e70509ad2bfbe938c2caa8241965930f553cf3999fdbfe77d2f2c200881a89211100589d7d5820f652bd571bf037dedbf246288dcfd5c3fb77
SSDEEP 24576:XTAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:DAt6+dc0gQfM956TQ
TLSH
T1A8352391618F8CDFEA0B0879C67DC380C4B66C0EBD220556E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 7f08e48d2a7cdf2724c0f3374135ec47a6e9718eae3e317d851c2940cbda722b
MD5 a69d98c7a22ff99755cd11ab063bad10
SHA1 dcf81ac4e16f32c72549a32c949d382e2a2dcf7a
SHA512 194c4330cf994e7775e5b2769767bdd53b8ff35a03eb91044272b28f2fb8c0cf1e0b1dd67954d8e0a417a9eaadfffc9a5ea209afecc8e86bfdcdc05f5bf94182
SSDEEP 24576:E8Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:DAt6+dc0gQfM956TQ
TLSH
T1E2352391628F8CDFEA1B0879C67DC240C0B66C0EBD224516E555D97FCB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 5beb1b973fdaeab3f265258d952e00ff20fc543bf6c26e677ae9bbf3c83886b3
MD5 f3c4b7043daf965baf3914db4dafd9fd
SHA1 4effcd4af527a7a04707f980eff1f222f21c1684
SHA512 049afa8124f64d02e1ee63d1f3293984ebcedfbfcecb5af599e745ec07568fb68971954e1fbb742263eac3e6a207813459ca12cb471ebc7e2846bd387356e2be
SSDEEP 24576:dwAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:iAt6+dc0gQfM956TQ
TLSH
T16A352391628F8CDFEA1B0879C67CC250C0B66C0EBD224516E555D97FCB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.3MB
SHA256 8392641eac97c9d111486afc408695e7c3eb1e34b42f3d1828ddafede7a04c77
MD5 2d6f5339ccf2853c06e1e399dfcd066b
SHA1 e4b277f2f532faa1c3ecaf7a3904a691ca2da442
SHA512 dfefa9e091a0d93d02491626cdfbb92ada160cdd0540572d6fc0b7eb7f57703af2398ef93e258d3f29ecbfd2d6ce8890fcd3a8fa28bfb552ffa65eb1a40352c9
SSDEEP 24576:yZMqzFVSOIAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:yZMqzfsAt6+dc0gQfM956TQ
TLSH
T1865501A5B3911CF9EC67813EC9658905D2B27C1A0B70C61F13A4366B9F333A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 c4cd78442b51227343dc81c56f80df3ac39c3216fe5b30ccc8ca820c7449bf45
MD5 705efe6aefa1f6a84bc371c23f875c11
SHA1 d9bd875020586cf198fd54603c6d19b4c74062ce
SHA512 4eb4bba91d1fbe01026c384a57eca0b0dc145f2415d9140407c6fdff2037299f53f92d699c5f81399fa4da199d0c31ccb9133f4b0801130a7ce4d9dd3139dc30
SSDEEP 24576:ldAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:7At6+dc0gQfM956TQ
TLSH
T1A1352391618F8CDFEA0B0839C67DC340C4B66C0EBD220556E559D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 a56670510bddcf89ba2f10b77e51ea70c89212fe695dbb180d4b8d31ef3d179b
MD5 49116d9acc331955b1e08f0b30f19081
SHA1 dbf565185c85ecd138577cb1fd06940857e88ec0
SHA512 8ea9df14eda7cdc57a4b5f77b7a845d60c65532528c93e0d49edea9166530d9b402964b40b5b7d553c9d980dcacea415096298c596f76a55111fe963c1a59caa
SSDEEP 24576:mpAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:cAt6+dc0gQfM956TQ
TLSH
T18E352392618F8CDFEA0B0879C67CC240C0B66C0EBD224556E555D97ECB33AD50EE2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 c6c5546bf9b537ebdc8a0b286416bfa966b7fac445af2459cdcdab53c2cabd58
MD5 290467f5484232a5ec5f1b0ef2a168b8
SHA1 bc5eb99fb677a24275c9967cf02b5f98c75b122e
SHA512 f3abac917442a9310a5cbf83edc47ccec0d728fa45c33a802f34ec6dc350f8047aad6418a195c18bdd63e9be75cc0ccb8cfbde50a163c5be5573b62230f670fb
SSDEEP 24576:ZzyUAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ZnAt6+dc0gQfM956TQ
TLSH
T178451253739620F9D5278138C9764A01F3B2B8365B308AAF53A4477B5F336D05E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 b83b7f82c16e67e757c02891242fcfad46c0f15a800429d120042339d03c67c8
MD5 f29cceede571886d63a9e07a904e220c
SHA1 8f16befddb47a497ff5eb63ab0aca1ba472b7d63
SHA512 e37d354727e53570f9621b4d108eb4ab48f620e4b7e24338410d1c6ac5f8f718d3e1f507d61d5c3d22c025f543f53a4fddd9cb195ae80c001db21d99e035cdbd
SSDEEP 24576:LdAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:ZAt6+dc0gQfM956TQ
TLSH
T1A8352392618F8CDFEA0B0879C67DC340C4B66C0EBD220556E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 4c2ac2e85b0f4ac472b587467b117190f5f411507f89aeac025324f001229d86
MD5 604cb84311658a908cede6ff4caa3c4b
SHA1 470d40f359024d14ae838d3e49b6cbd5b0fce021
SHA512 bb6a4d985de97e5320c4e90e610b24ef11beae4113146416aae12bccd68db826851753705769b2dfd992e3dd123b323f390c27b6c7c7ebe410323fb7330ed426
SSDEEP 24576:XdAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:tAt6+dc0gQfM956TQ
TLSH
T19A352391618F8CDFEA0B0839C67CC740C0BA6C0EBD224556E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 34aeec1ea69bf35c78b964bb92e59644d081a4c1371cfb1174e56d0e0a55d7e2
MD5 6c7b7c5ffbb20323477b32e016d9ff10
SHA1 1ae61d6bc6daf92e3150e46924576990063b04d9
SHA512 8c63b0399ab63645ab5dcf9b583f983f786e1bac5ff948d40cd9c5d86822183cc6b99e3f25eff4c59896994a9963267ba56498e42914fddca3d59b353c1ddcc9
SSDEEP 24576:vzyUAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:vnAt6+dc0gQfM956TQ
TLSH
T147451253739620F9D5278238C9764A01F3B2B8365B308AAF53A4477B5F336D05E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.3MB
SHA256 dddd199ad9cd2f4c5851ec7705edc03492a81a9c01177498fb76b18e0cc71028
MD5 19ee3ff48381b1e362bddec15413e598
SHA1 49b398dad65f1bbc0f137d8960f9495f95d49386
SHA512 40d957edb24e869a1c35fe4c4c0fee09d8fe5ce5bddc367797904664ed84bb0464dc3255ff28bf02e012aafd17d2097bf3e26be78c1014d0e3b9e3ee94bcbaa7
SSDEEP 24576:nTPaLl3z0zDyAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:nTSLljvAt6+dc0gQfM956TQ
TLSH
T17D5501A5B3911CF9EC67453EC9658906D2B27C1A0B70C61F03A4366B9F333A11D3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.5MB
SHA256 481dc88820fc4e0657b519f5c976a986a025d183ff1721b593dacf477049e358
MD5 e8449fa9f916dca498fdbd5ef235a26d
SHA1 1cb85cb897aa666b551ff0d1a6d0214aa0ba2f79
SHA512 3711612dc1e1de34379b4421ad68a934f011219ae25f06df8cd75d5c697c3b398e99ba9d70066475f14be408120eca5657950c647acdf07e39b248c4cebbac9f
SSDEEP 24576:o3zd9CHKy7GZWAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:yzd9CHKyasAt6+dc0gQfM956TQ
TLSH
T12F75CF90F3D814E8F1B78A35C9768511DAB67C5A1B31CE8F03A4665A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.1MB
SHA256 e565fa9ea39b051558b34d57c045280e451beeae85243ab867aa37c682876922
MD5 3ee7165868e3601ae61961cde3340a27
SHA1 0673fd60fbca9f86b75a34a65d1730e073218016
SHA512 03b85025e44de109fe192efa8d46e9705cf1fce89e4e0d932401b7cb5cbdb99ddbd613e8933296131d5bb61f514789ea592a8b0b9ea7d64aa5649b4a215bc036
SSDEEP 24576:iCAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:lAt6+dc0gQfM956TQ
TLSH
T1BA352391618F8CDFEA0B0879C67DC380C0B66C0EBD224556E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.1MB
SHA256 552630fe0b48a2a0b5395fb0dd8a6152c53eba749eb2fe62e66141407b8ec8cf
MD5 0c49b4bc2c4c40a2434097d5f8bd3f07
SHA1 08e583811b614b080b5084fab9f6d6516ad09c8c
SHA512 223e8ff990d7aa18bd086d1001757d156c50fafce8f0c17c95178fa38db287f57f2861f338ab5cd0cfb8278581f22c92a9cbe51d7a557f6bdb0031a5ee8772c9
SSDEEP 24576:N0Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:mAt6+dc0gQfM956TQ
TLSH
T1B5352391628B8CEFEA1B0879C67DC740C0B66C0DAD320516E555D97FCB33AD50EA2B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.1MB
SHA256 c395ebaca204d1d2a93e27b02fefc6314d9e367f40fee10503bd7db1b6a0b6e7
MD5 2d59dfe39fc4fd09d61b36eb663219fe
SHA1 92dfc29c88153b81b5cd381c3433653510c0713f
SHA512 38112fd7ee9068c229c5429388ec4d3a2d9fa4bd18780b4655f3e59b0736a503b09b4fbc90a0ea9cf2d7f610214c34957ad1083361169b3c63e62d16b8fd099f
SSDEEP 24576:MXAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:oAt6+dc0gQfM956TQ
TLSH
T12B352391618F8CDFDA0B0839C67DC380C4B66C0EBD224556E555D97ECB33AD50EA2B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 fbf6a54c22c0b6e65332aff7d5799c0c4dd7604c3cf58a73ff606e3829faa703
MD5 b5858df74115c22351fddd9bec167a22
SHA1 4832ba76b0fd5dd82e0b3b775d457e6b30e971bc
SHA512 703b1df4f5943ce46f0cfb2d027baf776b827454f4fbed3f75088cc5427c561d1e2c89ace85d3f310d13111b7c8307c4aa30eec7eee8799aa8d7696dafc66ebc
SSDEEP 24576:ztAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:5At6+dc0gQfM956TQ
TLSH
T1B845F056D28941E9C06E5179C7698640F3737C299BE293CB92D0F93E0F366D05EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 e9dfa8d232696696913cb8ea5452394522512dbd6654c80f596213ae29f88641
MD5 6b5e6db60ee0cb487c57ce88ca1cf821
SHA1 fb52bc86eda47f63c0c197044faa82b7a3704a50
SHA512 94282f54033efb8e0be2fab5eb23e810d8a6c118477b8bd74ccf2d2e8b870060faeb0c7d24d4274e24a04d3df3cb27121da41308779d01efc8ec85ba3313a4a4
SSDEEP 24576:jPAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZB:jPAt6+dc0gQfM956TQ
TLSH
T1EF352352638F8C9BEA6B0934C57DC220507B791D5E21894BE4049A7ECB33ED54EB2B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 198927a9c7b6557bda6d18af7ffff5bb9808ca98624eee28caa66c7afbdc66b8
MD5 e770a3c36675560f90b7b6fc1f7742c7
SHA1 404425d56b9cf757a906ec7ebbcaa49c97befdfd
SHA512 68b3231c3c962308759ee75d84e30659b24824ef922cae903050d3d3a2eee5a247194fd0fa4f20d4bd7967030f1f5c5d136071651d59cc927bb19b52159ea52c
SSDEEP 49152:Pa0h2GEkuAe73q3pp46zwwQtAt6+dc0gQfM956TQ:Pa0hNYG4Jw2APdc5MUAE
TLSH
T1B285AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1150853D7F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 f8f49f186842314adcf116afffba08302a2b3a6db847f5cc0c9b6c9416087b66
MD5 0de2e725cc17b47bb46ea3439c546d80
SHA1 87fa0c01a114d567ec24fea7d16be7ae1ac6e41c
SHA512 096a328aa351e744c856bcce1dc59dcb7a5108d6ce79bbfb87a1a5374aea320602f47b82088befc2b9b565aa2892ef1b78d5cb53ac13f4954564c587fbe74d60
SSDEEP 24576:whbHjP0Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:whbHjsAt6+dc0gQfM956TQ
TLSH
T1F645127E229D14D9E572917DC669C606C372B8291B2293EF62D1827E8F37EE40D35F02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.7MB
SHA256 6d34d0167c915ee91e980292a41a39534a635cefb5d23580082e83a2af6551c0
MD5 38de6c8e81853d8f33c1339385e017b8
SHA1 64aac76cff4b08c5b332b70859e86419a73db2f4
SHA512 de08e40f3daec97b7ef343defc3f8b024ff4a3762072f34eb816f44e1b7061c53141145e892d5a04b35cc1d1f30a484773b37b92736c36439e4c32f892bfa7a6
SSDEEP 49152:3IgnaTk46pWR/8At6+dc0gQfM956TQMAt6+dc0gQfM956TQ:337APdc5MUAEMAPdc5MUAE
TLSH
T15885E02DF2B910B9D8AAD136851143B5EB71782D1F209ACB4170C538AF1AEE85F35F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 71236108c07ebb13a4cb360a494262813832a6cc239234d882468d11f92580c4
MD5 604db960948c84e2c803140df0e4607c
SHA1 9a16e0732d38eee2350aa020f6999a04748e67c9
SHA512 7bcfccab5c71be8cd2830e02351640872a06fb7114a4b3b0056f360677a29d9582d3f5d6bbf6645e64a1e453ca603aa7bfaa41dca66357e922faa93286645c9a
SSDEEP 24576:j7Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:j7At6+dc0gQfM956TQ
TLSH
T19B352391628F8CDFDA1B0979C67DC2508066690D6F320AD7E055D97ECB33ED90EB1B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.4MB
SHA256 6726dadc417128491273b99ad63c587686baba77a1d773054d491b5257585c9b
MD5 3e3dba14141f6344019fb786b35d229c
SHA1 91977db0351ff6a07d66c92d16f53fecd35d0d22
SHA512 241ced8b2c99484623b7d5ffc4c428126cebf58d1faaefb15ece0de8f8fd02fc6d09ac723fbe11c1d8eab34dee0f96db3f99b4359b59f4341b3f615716b3c288
SSDEEP 24576:chL3UToAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:chL3UkAt6+dc0gQfM956TQ
TLSH
T1A465F155F79504F9E96B813CC976C612D272B85D0720E7DF03A88A6A1F237E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 fc3c4ffe6b7a5760f35920206f8322f9b5cc40274e7f4a212c8feb91af5b8af7
MD5 dd8ba9a8aac94562323ca9ba79515b76
SHA1 3b4b77640a6f2664a680f21d3d7d4a4a4eb3f419
SHA512 4cd956dc8137ceb27d0ae0bca8817f38103a44b1f2c9c1af7a311f09a419085d0c022886d0a58f9208126cabbf4669c460225a85c7c7846908996c52b861fa6d
SSDEEP 24576:TOEAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:TOEAt6+dc0gQfM956TQ
TLSH
T13945022533DD14E9E53A513DCAA6C309D372B86A1B2257DF4290817E8F63FE85C36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0b81bc596ac5a649b718a3a38b963049cbbae16d90e1b488790eb4ca3fb71d44
MD5 cf02f0fc8e411b87af1fe7ac9347838f
SHA1 a647df2f8a4d82d41ad09d801095f1e6428aea3e
SHA512 880236318655241ed8ebe3647c12f2508a752c078359eb5d0a6a35a7a233d6ac413d93b2fd2d63c9ffcc8018b7459780fe4bb13a2be23c46a0536e35da624bb1
SSDEEP 24576:n7NM9YqZqmWMUkPjZM48Mv6bEhsfAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:n7cBWMpPjN8DbEhiAt6+dc0gQfM956TQ
TLSH
T1F465AE2E6BEC81E5D577D13DC9A28205F2F2B4611B318ACB5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8fd55b195ab1af6361ccf029694f33bf1b894fa86b369428f6934d29fbb4fe66
MD5 248e8dc61b32205f2699af9e0687be13
SHA1 38776f508c329396a2d4b39f13bd913fcb1ceceb
SHA512 656a8db1f3aa64fb7107ff26a594dfe914b6f265f35fb429ecdc3b0e9f4735a64653f0b804bd09d4d0cc2c9fb0bb6555181045b5d044895ab40a17ba54751e6e
SSDEEP 49152:WF2YuHNETovAvNYf8km/At6+dc0gQfM956TQ:X6BCf8kEAPdc5MUAE
TLSH
T174858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 72261bfdef184b13d0d3e4acfbcfd796311ed1dd88ec3050ffdd6993933c5e0f
MD5 50c7e88bc33914811dd3485e5109a90d
SHA1 e70915449370fb45c3345208f1645d561314ec97
SHA512 4d8dfe9a4329f5cfaebe90f3e7be54494c0038fb3abc2b9b8d1128df2515f8bad6cca20beb0e2d55a4cb26ffe9f4038b269956ec1c99119765f96896550ab9ff
SSDEEP 24576:QAFs06+Omlf3NXEbToAAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:lFs060lVXuNAt6+dc0gQfM956TQ
TLSH
T1E265AF2F62EC00D5D07ED17D8A97C91AF6B1746707215ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 071d592d27a5ab127dc6fc9c9373d8c1516a5f556ed6500b39678d40bafe7561
MD5 982bdfb40e20f8574c5b43ea4ad204c3
SHA1 87f33e6e11cf09d28b9fb082955535b98030837c
SHA512 c12369c86526a06245f72a421cd661d368be75ec8fdd032f2d8dd67dce88d95e4f77fe6aefdff14406502b42945e48929d66175d1c8232fe3e11af2bb872094c
SSDEEP 24576:yJnJ5D3WUNAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:yJnJ5DGUNAt6+dc0gQfM956TQ
TLSH
T14165E02DD29810E8D4B7C274825A5746FE72383D2F226AC728B4D5357F12FE09A79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 0b1befc3f1fb36dcb2731804a6b026adb2de981dcada785e92045b024553ab74
MD5 9587789de674fb970e3d9c76ba7d0f53
SHA1 b3a3e54c6640932b4add07f57a8a4ee849b76114
SHA512 ce98f35a503a88c80cbc0407a1954388a7a8aaae0aaec7d8bdba001cb35092749963fadc0cde81efcc3c8499b60c80c2b27d089ff2acf620a161a7de0f08fdba
SSDEEP 49152:bg06DIKdwc+eQnSt65aVzAt6+dc0gQfM956TQ:URAPdc5MUAE
TLSH
T1CA955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 c4d71944770a9714413d11bd9d09c95f429b325142476f2cd9885504183ff7e6
MD5 0bd72d01bfe3bfc992acc6cc338971a9
SHA1 7e27bc2d9a5cea3545ffacd8b615485b78baa204
SHA512 53b77a7f19cc5b77a08a21620e17811916577aafff73b55d2da1ec2159daeb2fdaec8d95d527c927cc3172b0521714d3f3f157a8eb120a3351b7ee79f85cae62
SSDEEP 24576:l/DAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:l/DAt6+dc0gQfM956TQ
TLSH
T12C45126D278E60EAD52A903DC5A5C644D3B2F0652B2217EF51D1C27E8F33AE91E39F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 f0ba03a5bbe246d611b63a83af02b0b7b785347fca80412f8de0c09e08882ba6
MD5 16eafe3c26a2b2a8f229c394241de827
SHA1 e5419b96c8c4035ce7ff7a655c9f788fcc2c4d00
SHA512 c2b93125659ec31163cf94593ac056a5fd8cbbe559a59853736bf5ea1d440d7160ad64ea1841ffc4d4a5d15092617d5d5674b3a61c1be5350c4e9261acb209d0
SSDEEP 24576:fIyyAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:fIdAt6+dc0gQfM956TQ
TLSH
T198451240638994D9EA7A093CCA76C2908A76BC246F2147DF9090EA3F9F33BD45D71F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 38977fe6d2b458e95691378fa0fe6086f5b9f2a63d486144a14fa4102af8821f
MD5 f9d17f14181c7a6eeb6b3c92ca268363
SHA1 03a59aac9d9165653e96944a742c115b34b940ca
SHA512 1a36891bbafceec3a5d3b4999c162dbf66d49960450ce30204dd548789dabade76bb2c2386658cd84489bdde504d0d128582b89e94fb84db877aa3c8d5fc51d2
SSDEEP 24576:v0Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:v0At6+dc0gQfM956TQ
TLSH
T15B352355228B98DEEE170979C63DC6408076742D6F2219EF90D4D97ECB33AD50EB2F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c4f571af5e54a6e1f59c7730925923b6032f76132e2f58bf69ccfc0906478022
MD5 8ccd4eda331ce2ace709a2832aabc149
SHA1 36a62fcd80596c8cff689b134dab189d5085b7fb
SHA512 5004c0f3a6e71b418057016a76b78bd3678fcc517058c6a01e94e24e196f4c27154282a48d6cc8c094c21082b744f69959921f1e65c433bf2fd9942f3b437e1e
SSDEEP 24576:bQ9MxZKdcz9dw3XAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:bVKZXAt6+dc0gQfM956TQ
TLSH
T110557C2DABE9099AE177D23595A240C3A673B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 10fd560c48bf4f76fea2104f84d6329c531af9416aa40294ef7ce0951e9bbec5
MD5 cda2b2baa286f1d7e7fc5817291ced8e
SHA1 8a513201d5c344b8126d31948ef0af101deceaf0
SHA512 94b9e573adf92ea1d7f84c766a458bd5326e0acfc4859a1486fa7166141422edf7cd8d626a111d50c703b3a27b495e97e6032baaf8b3718546729a93ac7dbe17
SSDEEP 24576:LyocrApOAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:+ocrApOAt6+dc0gQfM956TQ
TLSH
T10555E01FB7AE40E2E166813C89958345E7B3B0345B6257CB5591C73E8F23AE9BD34B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 37fcd6c78df62547b60dc9ab452ecb243b225c4a1b5e0651663c61d7e7c06cc8
MD5 e886e23a8bcff86eccfc3a2e7a6d1d8c
SHA1 3b1c95d070f424fbafb75e5eae33b2cd6e96442c
SHA512 1f74c5522fd118bd44f543cdadd584cb222f00ea40111873af3391556435350c9c306ec82170d0c7f835b57abe772cfd44cf5c7b0453738945bfe0efb1a47ec1
SSDEEP 49152:kWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKOAt6+dc0gQfM956TQ:O0zuNIoAPdc5MUAE
TLSH
T11DA57B3DA2EC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1fc4cce17854c63615d0d80ee72a409ba2e62965fa46ebe5be6684fb5848ef32
MD5 9c47c48fb3637114dfd090034e26ee3c
SHA1 52ec50d12f490e205ac8e08a07bb84bd4eedabd4
SHA512 03e6cee3fff5f3fc1d3f86f83acc7ebec82efc1ff8b23fa1485940f4571cb21b4794fced126b2a78d86032572142c7dbb6821d498b20552ffd2474662c3a177f
SSDEEP 24576:/1QT7EcpfxR+N5AWAz3ooiYtjMqbDAl5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:CTDxR+N5YzTfjMmAt6+dc0gQfM956TQ
TLSH
T15055B02EA7F915E9D17E85798A33C502FA727821073193CB42A0C17E0F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 79ecd863926aca3b0cf60717611ed74e55a87bda9b7b2e7be331f0f3fa2edebd
MD5 2592bcf3456d624cfcd0fa8a41f6b5e8
SHA1 b6d76fcc95d9c7872c72050df953989b2b28553b
SHA512 1f205d6efa4ce7ad27c3be31eef4acd3c49edebbbc28e1b2770e0505c12ef20c4baa416690db5dd837ce6eb2db988da474a71a4da0d9421f40aa4a5cbe2ec647
SSDEEP 24576:c3YgnJcRTk4yti+R5dnR/8Al5zuQ6+GWZGd9iwnsOTQfM956R/RQH3qwZ:cIgnaTk46pnR/8At6+dc0gQfM956TQ
TLSH
T17445BF2DF2B910B9D8AAD136850147B5FB71782D1F209ACB0170C538AF1AEE85E35F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/216-45-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/216-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/216-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/216-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/432-11-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/432-218-0x0000000140000000-0x000000014012C000-memory.dmp

Download

memory/512-459-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-438-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-447-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-450-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-433-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-434-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-451-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-436-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-452-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-446-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-449-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-435-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-445-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-432-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-430-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-429-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-428-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-427-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-440-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-441-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-442-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-425-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-426-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-424-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-423-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-422-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-444-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-443-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-421-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-437-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-448-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-456-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-457-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-431-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-461-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-439-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-458-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-462-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/512-460-0x000002051F950000-0x000002051F960000-memory.dmp

Download

memory/820-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/820-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/964-316-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/964-453-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1196-420-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1196-308-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1664-304-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1664-419-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/1664-299-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/1664-297-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/1852-327-0x0000000140000000-0x0000000140117000-memory.dmp

Download

memory/1852-275-0x0000000140000000-0x0000000140117000-memory.dmp

Download

memory/1892-292-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1892-286-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1892-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1892-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2612-455-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2612-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2696-70-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/2696-72-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2696-59-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/2696-67-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2696-65-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/2748-235-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2748-82-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/2748-74-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2748-80-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2948-7-0x0000000000400000-0x00000000008AE000-memory.dmp

Download

memory/2948-5-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2948-0-0x00000000025C0000-0x0000000002627000-memory.dmp

Download

memory/2948-33-0x0000000000400000-0x00000000008AE000-memory.dmp

Download

memory/3504-282-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/3504-406-0x0000000140000000-0x0000000140118000-memory.dmp

Download

memory/3620-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3620-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3620-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3620-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3840-265-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/3840-323-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/3840-271-0x00000000005A0000-0x0000000000607000-memory.dmp

Download

memory/3840-266-0x00000000005A0000-0x0000000000607000-memory.dmp

Download

memory/3940-258-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3940-252-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3940-251-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/3940-319-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/4168-372-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4168-505-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4168-417-0x000000000B3E0000-0x000000000B3E8000-memory.dmp

Download

memory/4168-333-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4168-388-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4168-404-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4168-411-0x000000000B3F0000-0x000000000B3F8000-memory.dmp

Download

memory/4168-412-0x000000000B3E0000-0x000000000B3E1000-memory.dmp

Download

memory/4224-315-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/4224-247-0x0000000140000000-0x000000014013B000-memory.dmp

Download

memory/4372-245-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4372-242-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/4812-472-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4812-328-0x0000000140000000-0x0000000140148000-memory.dmp

Download

memory/4832-15-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4832-23-0x0000000140000000-0x000000014012B000-memory.dmp

Download

memory/4832-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4912-454-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4912-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4972-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4972-313-0x0000000140000000-0x00000001401C0000-memory.dmp

Download