29d6ca2b33d6aad013d2130d30cf9ae72eefd533f1169250e1b2abda132e4762

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Size 1.6MB
Sample261013-2lt8dade99
SHA256 29d6ca2b33d6aad013d2130d30cf9ae72eefd533f1169250e1b2abda132e4762
MD5 b28bf174be6a106c58cbd81860cd5f32
SHA1 8c44b85e44a41d96ab1a4a4492f0666318d8ba7d
SHA512 b00d8a8ea4a1726c1dda7010aa66a08f369216aacfc484f47f29678d69530cf902e4f9993f5ba28214381d0459ee2607c9243f5b2d011a3027a28088ea61ae7d
SSDEEP 24576:D4l9rFNSEzOVIWxYqAC/PT+S1g0xHnxC4bZtxoEgmK0:MDSEz4IOECS4g0djtLhVR
TLSH
T129750202B5D14432E9B315364EB89771ADFEBDB04922DEAF2384591EEF315C0D62A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2524	alg.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
4892	elevation_service.exe
4364	elevation_service.exe
3844	maintenanceservice.exe
536	OSE.EXE
5072	fxssvc.exe
3180	msdtc.exe
1044	PerceptionSimulationService.exe
620	perfhost.exe
3796	locator.exe
4544	SensorDataService.exe
4408	snmptrap.exe
3204	spectrum.exe
4368	ssh-agent.exe
3192	TieringEngineService.exe
2960	AgentService.exe
1308	vds.exe
2404	vssvc.exe
2200	wbengine.exe
3396	WmiApSrv.exe
5116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5f11eefe862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f23a61f645bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a846d21645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa84c71f645bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005cc2841f645bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004abc1f20645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005be98b1f645bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ecd5120645bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000752d720645bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1988	DiagnosticsHub.StandardCollector.Service.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
1988	DiagnosticsHub.StandardCollector.Service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe
4892	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4772	2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
Token: SeDebugPrivilege	1988	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4892	elevation_service.exe
Token: SeAuditPrivilege	5072	fxssvc.exe
Token: SeRestorePrivilege	3192	TieringEngineService.exe
Token: SeManageVolumePrivilege	3192	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: SeBackupPrivilege	2404	vssvc.exe
Token: SeRestorePrivilege	2404	vssvc.exe
Token: SeAuditPrivilege	2404	vssvc.exe
Token: SeBackupPrivilege	2200	wbengine.exe
Token: SeRestorePrivilege	2200	wbengine.exe
Token: SeSecurityPrivilege	2200	wbengine.exe
Token: 33	5116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5116	SearchIndexer.exe
Token: SeDebugPrivilege	4892	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2960	5116	SearchIndexer.exe	131
PID 5116 wrote to memory of 2712	5116	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b28bf174be6a106c58cbd81860cd5f32_amadey_elex_luca-stealer_lynx_njrat_play.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2524

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4364

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4136

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:620

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4544

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4408

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3204

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2336

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1308

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2404

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3396

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 351319689810d1d08a5541eb3bcff5d5cb1f1e24014188070419acbc5e482b41
MD5 12ef9c971fe60ea9cc947f0e2880cb5f
SHA1 dcfba2a7610182e15ab9222ba235b04ead3f0c89
SHA512 5a4a0844f95c8636d1b91323ff39924a7bc838cdaed2aed4d5563ca1331c83f14e0bcc022ecb26b8e1dfe53aab34e70618847dc9373e3256ebae297d7d441c23
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxntCS4g0djtLhVR:j3q6HjBEL4/dxL/R
TLSH
T1DFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 48aaf129785db852d60119471b210953e148c90a0b9731f0145da6cc81ce4615
MD5 f9c1488bf440bf26dce17ba919c1ac6a
SHA1 a0bf6012effcdc12d5797379512fd731cd0e40bd
SHA512 b999350c76b94b0c864403e5cb37fc15148ad1377bcfaa191ea102cc2363a01712f32dea6434b55c7ec44aa2df412279b9d497359713cf16b8c4e055debd4f90
SSDEEP 24576:DXYfDtczA8qAC/PT+S1g0xHnxC4bZtxoEgmK0:GtcfCS4g0djtLhVR
TLSH
T17A75F128779409F9ED6B827CCDA28501E6737CA14760E7DB03A4A92A1F333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 b79786537f810003aaef7bc617d7f4d5b83ae5017007f971627ffa912aec4a8a
MD5 b91e2ea55f922428335b11d9e6fd376d
SHA1 029f2f23b3cb5193e5babb67dfa9ae42c328ff5e
SHA512 71a418e1d23010b0fdc57a6b1d5c4f7a5e0746cbe26dab0d44c7576e158272e3b451f26dc06393dd62da1227fe44a998ae466fd1d5a7d9ca640ac2865b7a209a
SSDEEP 24576:g0Le5ji0hmxFrMfqAC/PT+S1g0xHnxC4bZtxoEgmK0:gPji0ArGCS4g0djtLhVR
TLSH
T1CB959E26F6748335D073C0B9C5D2A68AE971348257308ACB4286D77C7E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e839cbcd2f2c515a2d78a64c83e0e6b50ee47929251f76852f522e52c704cff
MD5 61d2863db60819658ce88249ebcde8d5
SHA1 398984dbdf7309ed2adbad15ff4d216e6e3aab1c
SHA512 d6e89f0fd3505c726c5cdb995119add253325ff43cc89795be45d248f64015ea8378f243be8555f97163b58ac5cf8be79481a26522ee439354bd665717d05b39
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyulqAC/PT+S1g0xHnxC4bZtxoEgmK0:I/ezSC6vUzPvxHjySCS4g0djtLhVR
TLSH
T100755C25F5788323D0B2D0BAC5D6AA99FE723086573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4603911b3a2b65199b84cc60752386d3092eaf0db8b83ec3a33ca7d4933ac13d
MD5 9f99cb87ff1429096077c88f7c8f58fc
SHA1 3b223970c28d64ae51d6a6e02f81fb8514900dcf
SHA512 39b3556e7cab2ff60f6d81fd6dd60ee4d7b118339180afacec65f2622cb68de77b0db3986773195cf656ba7bb899ed37829ae62661bfe5e20748c06d43471819
SSDEEP 24576:PVbqPb88hv/l+6IqAC/PT+S1g0xHnxC4bZtxoEgmK0:PVO88hXl+xCS4g0djtLhVR
TLSH
T162559E66F5748331D073C0B9C5D2AA9AEE3234425B318ACB1246D76C2E777E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7d89649c4a22532a207d746287c96842b4b4d1916bd825299469cd5967f3eec2
MD5 07835737ffd97f43845d2db38d2f35cb
SHA1 76e60f2656be80f33be1ea4c5ffd976a23326afd
SHA512 1be9b887d7276336a125b29eccebbbe282e76ccb6d89bf01eb8cd0a47d38d8d966e3aa4c06f6415349677bd0a4055aa71cb089f9921cc39ce04203606afe7a6f
SSDEEP 12288:yNTRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:yNrqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1C265237A9718169EFB9F06F0CEDA8281F4D19EF09111FAAB9644B90F4C3C560C86F432
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 27e33ec147d579a8664e9ed70b450ad73760727b2495324c04b119b87b909bfa
MD5 6fcf2d374e56d8360b9027d29a695e6a
SHA1 76f2b1b9b9903acd4ae2d487456b162be6cc3082
SHA512 132f657d0b1863ed78a0490b4a10ca1c42f26921d46bd3ae888960955a27f9fc11baaeac76c8a8bfb8c01585b72a2fa4544376e04747320e198b9fcba69bcb31
SSDEEP 24576:IJIUwqAC/PT+S1g0xHnxC4bZtxoEgmK0:IJIUcCS4g0djtLhVR
TLSH
T14075CF3BEE28FCD2C27E4DB85A918640E7B278704B11A3CBD165920EDE335E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 de2d33f4390e6ecedb41e6474410a5742366a430968cb716e4fae9ae1a1025f9
MD5 6e3a5c282fb83108d2936fefb08d59ec
SHA1 3edd1250a572f5abb348154134940b5adefa803a
SHA512 957eaf212804c7697bb4f30dce2dc913ea0a870314a54193a78d71f613133a80c122e67d8471a6bb7b20e3600577683f260adeee15285c17b50dea4883ceb25e
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:GQvGAdlCEL8c/yRNw5C/L4/dxL/R
TLSH
T185267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 5c5b057c875b6b0f10f0cefdb38063f26ebf5e6d1524f2e4183b76b613955f25
MD5 74518f38f2fa532c3b43edefd3126ae5
SHA1 774b5879cc49dc9982cbe056518d538ebce7c809
SHA512 4fa8c34bc60588cec2df69d3404740e086a2aa78e9b86a727af990005ccd2a409f613b12071bb92d3bca8a5759e93bc4a2c0abf8d9930d3985ae854d336e3b9d
SSDEEP 24576:/6ewsAjOqAC/PT+S1g0xHnxC4bZtxoEgmK0:Clj2CS4g0djtLhVR
TLSH
T14985E031FE74E036C7BF0DB11B26C706646C7D604B512AC3E3A89D8E59342D2677AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 580592ea45fd78a7f4caef978d78bb1efebb47ba25a4d9c28c830267133b163a
MD5 465de8e9fe0ba0472ed02084a1b7829d
SHA1 6fa22cc06b77060250f120bec9bd361d2d4cd6e3
SHA512 69e2da66da553cc87774501b8d9255d54d19f07cd4214a37411348a442f2f8b7cce7f9535afd0a9f19f23208ddb93a079882fa77d03a27069ac67d2b01a60be2
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHq41pR:WUEtQevvqc2W1cpV2EI32n1r
TLSH
T15C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3e8e06f4b323c617f6d63184ebcb6a9e506bedd41bd2d5b8fc697568822d1908
MD5 b6505ee5963e7cdcb81a84397a6e6bd8
SHA1 0da491b8b7bec07f2490629279b261534ea99215
SHA512 c931a8da8967618672bcb439def5a4849cf67dfd80f35d70cb5d5f62c7caa187d421c84a4d4a79ae52f1437f3a6fed46b393de1107c910b17775d8dfbd803054
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zWCS4g0djtLhVR:yoqtVjnmrL4/dxL/R
TLSH
T18AD58D1976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a902ecfe8f8c4c53627302b5b203d0de0ffecd19cd8d5275956942d8a642f873
MD5 3e1526227b98570c93ee66bc8828e572
SHA1 3a8644420d59df0dfcda771695268919ff8a1f07
SHA512 2b9c5345120e54a8dd49fbf524ebf52faf8203e2a98e561bc438bef1e6ed8a1fdd05829639f5542ff7c3da77be5b050b3130b99a7c5ed0f665b209f6d8c3bd2e
SSDEEP 24576:nAhGLJIFoiwtA5l7S53ZqAC/PT+S1g0xHnxC4bZtxoEgmK0:nAMyFoiq5bCS4g0djtLhVR
TLSH
T186359D81E7F955D4F5B3AAB89DB68170EAB6BCA65E31D20F2150D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 1bc531fc36368d951e6fefa0c666deea0910f97bfbd8fe953395e0628a7b893d
MD5 2491d80392b3fa6e67396372cc057e72
SHA1 d4e7d19b1f63e1f828e7d66146170abe04c4c1b4
SHA512 251dcb8a5c8422b81bcc6a0c6932d80b52587bc60ae1484d8018be79ace8fe7a5af0bcd371dd71cbdc61156d2877695e01dcb07b110157ffa51917e520a79c68
SSDEEP 24576:twuFOWSqAC/PT+S1g0xHnxC4bZtxoEgmK0:twKO3CS4g0djtLhVR
TLSH
T18575F14A76A40CF9EA674278C997C132F7F2BC512621DB1F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8f82c32796edaedc961038908d682ccb897fe348813faaf37c4c4c22e07fff10
MD5 abc15477a20c307b598c218e26bc0b60
SHA1 5f2ec545ce614f9461dee062aef3b0d3e3e6e787
SHA512 0227c1be4eea974f06f987ad56d6303bdf976497635c7d5d9647bded65b0fb6fc57a565767219aace46b438abb0b00ba25734a509c5760765eee73ddcbd230e3
SSDEEP 12288:LFZ1IyiRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:hZunqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1E365126A33A421F9E29742B8CDE58641E7B17CF1633293CF1614625A1F36AD18D3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5b4e17a354611f0e49e28f2945c030833f2e3e4072a3118234ca4ca28954b792
MD5 31771f6fec75cb40bfa46c7763c82f17
SHA1 946f63c688f65b818e332ffb629b42432c1690c6
SHA512 eb479a2e6ecb6e5651178385b8af9610f506278923e322a6cc51436883440850555c787287c22cdd6af5749e9beefe0f9926a9cdf6641f763df20b18a0de08ab
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN3IL4/dxL/R:3QyiKayX+PN041pR
TLSH
T12F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e749060aabcdab3beff79ab0f50b2085f25afb4ae34cac7214745e8c70d8c40c
MD5 f64eb0a2a5f585b9579b85cd66e4cbe8
SHA1 e9faa075c7986b7c650a6655541670a8ae165442
SHA512 3caebb2a059912e8b54104aab697f7d6cc135965391369774e3ab2c03f80818f450b5ca9eb20b02aca174d9a927f206f068d96eea00235a285cd36abfbaad546
SSDEEP 98304:MQRQyi36YOcPQLvw2gAf+PN3IL4/dxL/R:TQyiKayX+PN041pR
TLSH
T150667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c52ab8a3284377bc0cafb4e028d19ab8f282025e8e7e7b29e2a1469c038096b4
MD5 ce71e8cc6a93ea9a4ef5370791e5394a
SHA1 9c4757664457d7ab831bc953f916d167dd40ffa5
SHA512 1e3dd24c4c77874a1fe4657188e6afb9e44e387c0de9c7f92357bbdc465c71348063898936e1e33ca148297ca83d19ed468b227d9f5e6f82a8210db58a513d44
SSDEEP 49152:g68Qg55nhheWu7PNU3/GCS4g0djtLhVR:athWRc/GL4/dxL/R
TLSH
T171B54A33B2F600A9C44DE1769F4A872196D17C718FE1E3DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2aaf111a237ec10e2565f179111341add9c6490f99bc201d4a041e9d7f9e5613
MD5 7518ecda2da939ebbb5f5a291834044b
SHA1 e392570d99213d1e5427f5a80a057ba3725165ac
SHA512 0a873197fc484c78f953c10159f29da9f5c7ab7f564d182c38240339512ea43cf8baa350356c8a77568932d0866553db058c42e0ba71f4dfc6b5e1ebad984aa9
SSDEEP 98304:gy5112gYy5azzVvL69nLKnhZpL4/dxL/R:5LIHmWhP41pR
TLSH
T11E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ab83a125d55008d6afbf04039b9aef80811c992ada0f1e379edc65eb7b5fbcb6
MD5 13b6944d37b308e215b488188edb4b27
SHA1 64a193cd1c0bea1bf88d98e130091ca471513104
SHA512 528e76816f0c0949c0e7cdbfb02b92a7a7dd1bd1836150580467e4026631fa779eb8f4402f827d063a7cff1602826f3937e632b1726abad4af45745f82ba89db
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwCS4g0djtLhVR:wu6JmVxd2dwL4/dxL/R
TLSH
T1D9D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7e64c7371f24a5ec1d6cb2a8e684763ea9b7e61c738911dee9bc39a415b60c1c
MD5 b8a4794c4dfd65a4d358fe61cb85ae2d
SHA1 c0065a32087c2a30fd6009d33168b4d83d1b136c
SHA512 80255c70c8dfb9481320cdbdc83ab0a8d8ee6a633d7ed25968cc367b39e61e04ef8f15fe406ecc63a2c6d3ed5979ffac8d07bf392ed87e80e3d7dd252bd0f5b1
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4x8CS4g0djtLhVR:4mifPbRrL4/dxL/R
TLSH
T131B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8a6ce66647a4a1f1527f29316f9915a8b790a33b7d4a9e9d6305d621aa6c27a4
MD5 2fd672c81bc7c9132df52f5dd3f76ef2
SHA1 4956e00d4384eed864d941e00e2e97f76e727859
SHA512 01444d077f12b7bec698d4736ff9b1a16bd540b818747cddb406853e7228f7ee51e83a65233237beff6d52ac52d2f6c78e58967a94f6bf398fdd5098da30c58d
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqdCS4g0djtLhVR:T5dKTi61dL4/dxL/R
TLSH
T1D2C5BF13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e8035e57e603a3c4fec11becee6a7cd0f12196582d900872f954d6cda614c8b1
MD5 190c115954bc01c02db162b97641e085
SHA1 791c6bf73f2a998b355e6a2dd6fcc9e115eafad1
SHA512 32e1cf8576f9456b283efb409aff421bce3b2dfd630943da5274081fe6c2e9bcfb7c078d9f0c9c4ca81fb68c2ea733ed294f505876ddce79f66c898f3bd399d0
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wgCS4g0djtLhVR:4X2iyphXL4/dxL/R
TLSH
T14295BE13F2D901E8D05ED1B8C7468632E962BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6dc0162247a77c05a2b87dbfef3aabb03f2e63be60169fc0aa19e51520743ce7
MD5 c3e52019cfb436e37327e74a25229d14
SHA1 e83a2d3d460e28105a480a6b7e4f1ad76b4376a0
SHA512 c2b237047d948370ec1652159439a958a77bdd2b83b8125d9872293141c6e3e9c611f2f60fd5d97df20b32c772d01e483966939e3e77a5f7ffa61563671339f7
SSDEEP 12288:6rRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:6TqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1C565237DAA19179EE74E46F0CED68280F4D45EF1E212F6ABAB48B00F5D38561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 3931665daffe3dae5abbb37425c300508a3399a13f7ed113edb747f5470a40a3
MD5 274e71512652b7cdb8ad3ab263ae1693
SHA1 7b91e91ff356ab1201387234cfd89b76952d15f2
SHA512 5fd97958836434cb9ba8f6dd47077553de04323da830edbad1cea972137bb8da1d892fe8cf0873fb3490517698b03a409d5592a957263f9e2a067dd18a761776
SSDEEP 12288:2ORZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:2qqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T14B65237DAA19079EE74E46F0CE968280F4D45EF1E212F6ABAB48B00F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c086f4bb211aec43a6fc845f439bbf16a13e3a43d8c9815af7cdbb6f98fd24bf
MD5 7dee0e84f60868187bb520e3557b2591
SHA1 846c2b74289916a852dcc19ded1bad316c7253bb
SHA512 fcbf97736e3cfd9a4ea67aeacfae66d432069e722e371385bc3d1c5a689756147d274e115de12d814b629b9e08dee7f73aa062c90b833f9ca900031f26883ec9
SSDEEP 12288:T8RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:TYqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T13765237DAA19079EE74E46F0CE968380F4D45EF1E212F6ABAB48B00F5D38560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 609d05037e45289c897e0141b0edddcaf66698247c022b3a18baf691a1663cc1
MD5 ea928146336fb121b24e738f388470e1
SHA1 32ed7414358af684f87a76dea00e51051885dd24
SHA512 a201d519b55a218fccacf2ede469d98f4f8e94d72512ba6a37386eaf18a397d313858655ca00734f178b035bf99ea105d794865b15282a193902e141f8ada2ec
SSDEEP 12288:oVJRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:YqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1BD652369675902DAE65A82F4CDA68241F5E5BDF0E322E7EF9700740F0D747A0CD3EA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 d59bce6fd4f24b1cf659f88b539a46784acc5d68e1c0b9edf2f24a733126c3d1
MD5 0861423b330a49367bc0b7df4b8d1bfb
SHA1 05e1a6ca306567c3124ff516a8a85c6cf334a602
SHA512 ce5514acddadb1e1887d995ccc005959f6b7b0e06e3cecd3b72e50396816a618446342b249c1d2bac171bd32c8da22e9bd3aad1c1125f4dffedcebec5eaf1314
SSDEEP 12288:3xRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:3RqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T18F65237DAA19079EE74E46F0CE968280F4D55EF1E212F6ABAB48B00F5D38570C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b935f2df89b5c4ee7dd05ec975e46cba93167b8018be306fb57817f427632e92
MD5 6fefd98f4bb82253c3e505ca39aec273
SHA1 c738448040a6f46bb3ec5751c453770b35f4af0b
SHA512 569c96a3e2cc872b17f6788054d47e74030cd2a08daf81c2d7fef3928531d635472d8e36ff078e11a5102d002a479ed4df69a08d6a93bb38664b9dad6f43bce4
SSDEEP 12288:BKRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:BWqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T13565237DAA19079EE74E46F0CE968280F4D45EF1E212F6ABAB48B00F5D38571C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5129ba1bfe550c1d4f0af9091406eff0cc5ec2c893f4728a86319d06cebc2146
MD5 431970c1db653cb467e0d3d4f85698e8
SHA1 87240df0e5b3548d9191858061ebf3046b6d39c5
SHA512 e018c42f5d13043f403d999d905416c57bf3769e532fad25c009ba8533da14b6c915cfbfb4ae824679df6c336d463b47af6ab3f5341c4f21096108ae463d5742
SSDEEP 12288:i2RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:iiqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1AF65237DAA19079EE74E46F0CE968280F4D45EF1E212F6ABAB48B00F5D38571C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 ae06fe0dc5bbc22136766e8d9c6fa70e48c0da7b2bff3b1e4bd5011f5e032b31
MD5 57057427839b0ed64fff782d70857881
SHA1 0a988a5a868b09084418069eb0ef41f2ba10cf07
SHA512 1fa3a8a8b1b9ba5463ac11ce222294a3d6910754de138258d2b2c00d498dc36c23b762c517c094e231ba6d3db440a0de472c9da45b1d8c5fa26fcef8758f844a
SSDEEP 24576:PZMdzFVSOKqAC/PT+S1g0xHnxC4bZtxoEgmK0:PZMdzfuCS4g0djtLhVR
TLSH
T1AD7501A9B35018F8ED67827DCD558902E6F27CA64760C65F03A4362B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 10d783d06a810d258969a6c978e4607974007682cbc81329c2c96765dce8ed28
MD5 6e8a93eb66f61f0cfc50384acb2bef55
SHA1 b77aad62c1f77cb210ffe08df64dcb9a65c9be71
SHA512 3fec83f17f0716cf4d56be99e12b5660f214f40623679c894c563894a16182dc1a0e88485d5495072cf1e01818ff439763c2a6b340275eca48ae98b4ed675b4a
SSDEEP 12288:9/RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:9XqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T11765237EA619079EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 a93259c085a44e7a77ef1debdf75411967079aa04b559128bcfb37b21dbe697e
MD5 bda49462bd2ed99526a5159c11b34f3e
SHA1 3c9aa6c46babc9b5a22dd4fa31469fe64c1f5e12
SHA512 f063b61ff79cdd0ea8265ee032c40486d462036e6bf79c095c4aae17c882f20c8421e0fd0c4664ab2c8863fa106effd49ed9dd5f4578169e163e5794d88c2378
SSDEEP 12288:dDRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:dbqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1B065237EA619079EE74E06F0CED68280F4D45EF1E212F6ABAB48B40F5D38561C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 66b7c0b64e68fa19cb7c1a0847137cbff8cd7e571fb01d93717b1625f2d36ec6
MD5 285087f3fcccab4660bfe5bea32724c8
SHA1 0718038f35a13df23dd39d90f8f7b76088254500
SHA512 e3edad2ce11c068b44e81cdada4bfcc52bff138dd3a704918fde6a6b30e32f9726ea8a5a61dbc1b957ab6257a30d4d9fbd707ae2b17c9af7a77e30df72dad316
SSDEEP 12288:PyPz5L8iRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:izy+qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1E575021773A531FDD16A8278CDA20A01F7B1BCB14720DAAF5754667A1E376A08D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 b8de4107602d633f85c87a092a92fa5d23633a2fd143e0262157a82f6c6a07fe
MD5 d092a2d498f6a37437c18f4979fd523c
SHA1 f7e7b71645ad406c97c73e05ebd47f20fb4b6cb5
SHA512 0d3b1b542d4fea6e82423aa83e5fc1305499cfa04ac8097934b67e6c45ae310d25e183c8063cac940c815000d008ff1eec51833851b28c23ee92abc56e48110e
SSDEEP 12288:g/RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:gXqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T16265237EA619179EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 ef8eda3fbdca4b2fa33bde5f34304acaae760ebe2e4cc2e172b6d8af9749c784
MD5 d497c28f4692d2c2c3699f8fe4594093
SHA1 8a41edcccdf8046125f7291e9e8c76d672493393
SHA512 311af123b43ba840329c0a4dab935d520147bda8566249b3f6d07ae53045a99898aaaec040792e93fc8e75d3dab3125b5de5126229853ef163634f883105059c
SSDEEP 12288:7/RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:7XqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1C365237EA619079EE74E06F4CE968380F4D45EF1E212F6ABAB48B00F5D38560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 511bc7327fcc6c6ae17732de4ca2c462172581895e28e75041ca46c678c6228a
MD5 018552c083d8f1874c042bef57256a56
SHA1 51859a05dddb62383ded0ddeb15e5dd32313655b
SHA512 a8e37d6cd5716296eec40c3989478eb1ca30281655a983005632de266ece3afad81dda859b4e676eeafde94f0c45d83a008a0ee1c2a7dcf605eee1d77dc4245d
SSDEEP 12288:eyPz5L8iRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:Dzy+qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T166750217736521FDD16A8278CDA20A01F7B1BC714720DAAF5754667A1E376A08D3FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4b5e7f97d2ce56bb3c58c829d93292ccb51b2b84e73f7271c22bdc5ce71c6c0f
MD5 f0e69234727741a7fee0c6e7cd5d4f09
SHA1 781304c5308252a986dd42b2cc64c30adc16091d
SHA512 ca8c6f9e2b43242e52096ac977cc3a06aea909ad005e076b2afd45cece141eb78efee0e78e6af49e4a19ef13ef71e4efeaec4ce42158dde948d427a44a0e92eb
SSDEEP 24576:qTGaLl3z0zDoqAC/PT+S1g0xHnxC4bZtxoEgmK0:qTFLljPCS4g0djtLhVR
TLSH
T1917501A9B35018F8ED67827DCD568906E2F27CA64760C65F03A4361B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 1730b8d45e3949414ceb42dcee226bcf765a9d43f48052e7c500e4518749a5d2
MD5 a33c809edde5bbdbe896b5f5b3a500cd
SHA1 5e50c9b3976c09277cd58caf689ed70b803fdd6f
SHA512 e4bbeda43e6406b41d5d70e783c6f9d294b75d1ac8cd93a114d84e96f212fb7e3b54f9d80692bb91455c0191ad46a967d4484a885744bf984c6646676b13d6cb
SSDEEP 24576:y3nd9CHKy7GZkqAC/PT+S1g0xHnxC4bZtxoEgmK0:Und9CHKyauCS4g0djtLhVR
TLSH
T19E95CF90F3E410E8F1B78A75CD768511DAB67CA95B31DA8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 31201bcddd2031912018c2e0219eaad5e8f78c10f9425cb6e94056080782c764
MD5 d8259f8681faed0bea5ceea3a0c1ff63
SHA1 e9e988fba0e37523414f3bd259392a1d52159f16
SHA512 d68025d64f648734f640b30987112bd9e67701c56a7d42ad3770d8861e359391da7f3c3b11fc48e51bbc5d6ebc2b04fb388be5397528eb2e1e8f0f5dcb636908
SSDEEP 12288:ecRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:e4qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T18765237DEA19179EE74E46F0CE968280F4D45EF1E212F6ABAB48B00F5D38560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 563466ed440a455b638eb74df89d908f9b96a48a2007135fb89f868b4e622936
MD5 9d11054cd5ff4570bf0a7dcd25d83032
SHA1 1c238036a0696c34e99ab328ef2815317943128d
SHA512 12b3d70c4aeb490ba6b036662d692aeab8931976ed193811a87ba04df976282ccc5fb729bd856bedaa5cb4aeba38544100c06e4cbc31f6559962e48ce79a69da
SSDEEP 12288:GCRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:GeqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T10565237DAA19069EE74E46F0CED68380F4D45EF1E212F6ABAB48B40B5D3C561C86F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 cfd72d2ec5820bba8adda333788c3ff303ca4e02fa24131f0681804bc0fd23ec
MD5 ed59a58049747863e72429f288509f58
SHA1 0f32d18f53777c00a082bdef3a4732510ac101e2
SHA512 f0db9258706f1e6d9dde423f92b93fd098f6e3a7736310adc0156799a41a8ece37988905045a1cce92b24c0663cd5fbee19a18480b68d4ab8aa37780ad596f8a
SSDEEP 12288:ENRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:EdqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T17465237DAA19079EE74E06F4CE968280F4D45EF1E212F6ABAB48B00F5D3C560C96F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 ba3da87f3b0c45102d0122a4e1168d17f3d04916dbab23690aef99f7d0b81860
MD5 0978af624e664b0c7dffde0f55e64e9a
SHA1 f7d192be2f41855deca950c8b6bab480eab9b3f9
SHA512 2ae072b3bb620b31cfcef02db7f33843211a1a878e36f408bb328d3d3ef70abc8b94133ee57f2746cabfa1b630ddd78316d9f9caa40d70d5c1faa6ea3a038570
SSDEEP 12288:u+sfPRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:2nqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1AA75F11AD25802E8D16E52B4CB968641F3737CA193E1E3CB57C0F53E1F396909DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 8a04f42d2c607d28ef326569237f355c2a681ac28bf38852eb92ebc674d418fc
MD5 8cdf6aefa90c71fc4c367c77f6ecb116
SHA1 ade906e2fdfdc544966520b8d138cb3569b53bc8
SHA512 f67f68b2f2c2ea93ab54c958b2916022c4a201fb06505507c67e757bbda95a3293cadd71d7c228bc1ea46e2e03cefd2970168b77b2572d4c699f0aed41085df3
SSDEEP 12288:o8RZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:oYqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T16D65233AD71C1A4EF7AE46F0CD96C250B5997EF09B11E6DBE604B10E58389A0CC3F522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1938d1d92235596afdf58d38749f27611348579c33682e84d8f76a2fc762e856
MD5 486b674f80c4b893632f0ee24aae582b
SHA1 96ceb491ea0b3637b3c24934d5cf30326ab0f1a9
SHA512 3002aa68ad2ccbd877d526f6ab44b36311f0a545c2bf93be054688a87a1fb0471ab95236d7d3115d03d066e660f5c5d9d4d1b5d1bd6ac5773369b16494446869
SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQqCS4g0djtLhVR:oa0hNYG4JwrL4/dxL/R
TLSH
T1AB859E1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE48D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 4ce7c717d05eb1ab8bc17b31fde46cabd5f2900dfa26797f3d87d239f31f9334
MD5 394a214807603e496a67452b4c8eb330
SHA1 ba7a8a0d6ca9ff29d82bdf781a74bfc25181a0fc
SHA512 a7d15bc02d6eacc3fc5c028fe4bd57ebb3484ca6c190d3fa326cbc7170bd611177cd76715317e03d37ec855ea0b760439c3436dd6f04f2672b2b93c4e70e26fa
SSDEEP 24576:8hbHjPIqAC/PT+S1g0xHnxC4bZtxoEgmK0:8hbHj8CS4g0djtLhVR
TLSH
T10B65027E16AC11D9E67592BCC9968246E371BCB11711E3EF1381A13E4F3AAE44C3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 d218c674e0053f9e5f69f4d9e9e73c9e30fa7334e1a677285c4e109965bbe31d
MD5 90d66633debdb8a4ed3a234a09cbd29e
SHA1 88f18ca5d520524791408ad1b36bbae7010e4ede
SHA512 21d418806106c4ca7127b9235c51242ac212bd8181a32fbf594c3dd007b2d0fb0bce4223d5f53116e60758f9cb144df70e3c3e5b7adc38252cb08705afc4ce2b
SSDEEP 24576:33YgnJcRTk4yti+R5dBR/lqAC/PT+S1g0xHnxC4bZtxoEgmK0:3IgnaTk46pBR/PCS4g0djtLhVR
TLSH
T1C245B02DF3B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 e519ba08b216eee524f262eb37d6b0f2d9940d6fbdb48baf78436032b883ce2e
MD5 bda19c17fe230d7b98ef494fa083606c
SHA1 86a123f24e71b3bea304bbde21f5e24f1c397eb7
SHA512 a20d7233e2bb473193fcca5ef7fcfbc8ce687670fe6eba58cbf187c96fa9df0bd5fd65b2034cb4edbdd8103057c3465c764cffc08c8b60e789bf94f081d6b75c
SSDEEP 12288:3wRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:38qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T10365236D9619168EEB5E46F4CE968240F4C46EF0A322F7EBA648B00F59385F1CC7F521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bfbd91c062ab87ec368d6b482af23e2fe05f1dcc2ab575bdbc2e44845fb325a1
MD5 4a99cfa0d8063f3c6a1e4eeec24e6d10
SHA1 4c4823f068348854a87ea7ad4bf0a2c17db37d3e
SHA512 1fda332db345635ea7e33e7f94ef9f910c9f03fa077489e452360e0307cbb54560ac76e04af99ca9ad5633a83c626e2e2384bb9b4d4aa5a661d1b13fcec9dcff
SSDEEP 24576:bCL3UTHqAC/PT+S1g0xHnxC4bZtxoEgmK0:bCL3UZCS4g0djtLhVR
TLSH
T189850255F79400F9E96BC17CC9A68616E2B278AD0320E7DF03A85A561F337E18E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ae6686b9e302607c381285464276f4d14387444dad723e11126eec27b2854730
MD5 02fb9986b04c56c42fcd057b6710b996
SHA1 f8abf2e4b51216a97d6aaf1ccaf48e1b9c8bbc62
SHA512 ee4cfd461d31c1b6d22ce8d4b56febf9899f0ebd4b4ae4a3964dd0c949cac97c006dda17b4e6306a3436ec3b40d60f1c7bdfe1746e751b178c183b5d9ea1d077
SSDEEP 12288:1pFtkOjRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:gO7qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T19765022D36AC10E9E57A517CCD928349E3B1BCB1071297EF4280916E5F77EF49C3AA21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fb188f1eb58a25e75c7ef12cb838a91a238227a5e5fcb19fee89a0b1e00674a6
MD5 e058a55c46e937127cdcdd99d5949f1f
SHA1 36c725a022ce59710fb2d76e9354db8408cf7195
SHA512 2d3195aa9e31608febd6b4391f13b0d2f95e93d51d33bef5c836faaedb6f254e47f8250c0ca196bef42bc73ac61a60eec4d2d22b1f9839a23d36e2f345af0b2e
SSDEEP 24576:97NM9YqZqmWMUkPjZM48Mv6bEhsIqAC/PT+S1g0xHnxC4bZtxoEgmK0:97cBWMpPjN8DbEhnCS4g0djtLhVR
TLSH
T1FC659E2E6BAC81D5D577D13DC9A28205F6F1B8611B318ACF1152833E6F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5e32c6c49443e3a135d71b6dbbe359f4bb1add3bc59781570e3462c8c568a0bf
MD5 62d946eb7aa057c997ada7adea341058
SHA1 4aa0651184931f32d7218d400ea49286d9cac119
SHA512 702acc2207fe49651495478eaa243339af5d01a5bf7707d6a068fc918144ab21034dac3e0f65ffe34a3df56e560400a74542779991f6fae518d2152a138774fb
SSDEEP 49152:IF2YuHNETovAvNYf8kmUCS4g0djtLhVR:N6BCf8k5L4/dxL/R
TLSH
T15E857E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3056CF4255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b5e4db93d8e12fb0da0607556c7063258b997277226af74ab8ebc1a0dea4443b
MD5 06a9699e394b065e6487266d905965b0
SHA1 f2de080e9d6198bf9fbe6d04a51e01bb2466efbf
SHA512 00f04ec397996dbb417c0b6bd3342fbb754445324755851f8bd77d08e8f6a68a9ec8bc2050d32a0c67c3aa799729bed32891eab9341f3b70a0bbe1a09d053ec9
SSDEEP 24576:5AFs06+Omlf3NXEbTofqAC/PT+S1g0xHnxC4bZtxoEgmK0:+Fs060lVXuKCS4g0djtLhVR
TLSH
T15E65AF3F66AC00D5D07ED17D8997C91AF6B1746307216ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 7dd4450978853cd93c0e705b12460cb68e79dca4c50ea46dfbba447bfc899818
MD5 d3edd1afda122106ae84c799b977c21a
SHA1 5df70face194358e7bd84aad9d9d3586bda3a437
SHA512 a83a1663d8851b7cab45bfb8e6870e11c7a602f06e34ec99a96929f1d774cef736f96884074464e0d662f7fd3756a4969644d25bede16694dafc46638d9ac869
SSDEEP 24576:rJnJ5D3WoqqAC/PT+S1g0xHnxC4bZtxoEgmK0:rJnJ5DGoKCS4g0djtLhVR
TLSH
T10285D03DD2A810E8D4B7C2B4859A1745FE72387D2B226AC72874E5353F22EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f9da762dce3d2630820d2e944051464ec8ab3253e146595e277f31808f6f31a7
MD5 9e0dd81464ab1d685e0d5c2324e3ba27
SHA1 605763f83cedba6df50a206749038e59466003a6
SHA512 76d2f9a1cc55bc2655534c4d477c170c8d9a7841345d7b3cec2f4fcffbf560dd19ebbf9b7d11244ab6bfb0d5bfdecacc2bd08a777f5ae72b3ccaec238c76ad53
SSDEEP 49152:Kg06DIKdwc+eQnSt65aV4CS4g0djtLhVR:jOL4/dxL/R
TLSH
T148955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 55ca80b9df5e2a02aaea6bc256879f84ddc9cf8f93436376a88164369eadcbf5
MD5 b1daac6ba909b4b46ec9e297fd77c72d
SHA1 691d22049d969e00cdabe8162fb85cc5af8d9fa0
SHA512 5633192a190ac391b0e54c2df97916e9ec1312c44f57e2e85284ebfcc1ec9774eae273cd06924a9ca74839048a70cb856249a10a8281e4320d7f42954a3a84f6
SSDEEP 12288:DEP3RMDRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:IMbqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T15665126D675C30E9D22A91BCC9918240E3B2F8B06712B7EF5680E13E4E37AF55D3DA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 9a34ddecc33b549d2e0473e2eae70ebf41d28407674c79fc4d76b4fb2e78b3a7
MD5 2119c77c8917dc79b98440d5fe87e958
SHA1 e3abf547b60305965c80ecca7b405aca24b080bf
SHA512 d362ed814df1a20d20a0df3ba305ab06fe6d93f7526dc8f6e5953bec39fc8df66726e47059839c721616d5049be77e6e2a4531201baff0f4b6b0ccc34fc6d206
SSDEEP 12288:GjkydRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:GIytqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T17075131863585199E6BA06B8CDA38290EA75BCB05B21E3DF5180F63F5F35BE0DC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 cd4b80dc3aa438b55d84d927dda9990dc2bb5a6a70ee43d0fd321742ac9bd2d6
MD5 2f1a0fa6cb7af08d2c26a8baa44758c8
SHA1 d2a6f9ebe064a8ac9b8b0d88126fa11ae03330b3
SHA512 f8bccbddcfc7d430f5bfcbef5718f0dc5d4482af1878742a2b3b14ae014f1fc96fb5e8efd92006bf482c19f3b615e4a21ebea01fe01c73a6a3cc2721db3bce73
SSDEEP 12288:2GzRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:bLqAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T12165236D5229269EEB5A46F4CE968740F0E07DF0A712F6FF5584F02A8E385E1C87F811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 520f38e2ff6be56c1d359c24fc0bbb8c7420c97ae30a400463296ec13550e151
MD5 17d8eabd7ee4f6ab5dc5f27eb11dca27
SHA1 4ed15d70f8ffed101c838911ee19234801808be5
SHA512 70f9d35640118bed5e5f5161993edafd8e854939c4d69b72e125f348c054937587531b53e7b6cdb96c697b89f23cf1c653dbee6c7e429f142a90382928f4deed
SSDEEP 24576:TQ9MxZKdcz9dw3AqAC/PT+S1g0xHnxC4bZtxoEgmK0:TVKZsCS4g0djtLhVR
TLSH
T1BB558C2DABE9058AE177D275D5A250C3A673B4301B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 1005ad2e618d49af6bc6a131c4af5349eaa19dde1a2afa7adce36e36eac7687f
MD5 5a7d6e55b63865d466795fb41cdcb814
SHA1 42bc05a137252a886b1629e92a9098ac0473cadb
SHA512 42953eabec8c124ed4d6cf20d002dcdbd3b20ef530dc269e9c9048d85c835715d05ecda7902956430f083fdf4870e2d0d23ecca4f68e834199c935e51f572034
SSDEEP 24576:PyocgApxqAC/PT+S1g0xHnxC4bZtxoEgmK0:KocgApjCS4g0djtLhVR
TLSH
T1EA75E01FB76D40A2E166813C89858345F7B3B4705B22A3DB5681C33E4E37AE9BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2bc91fa6b2f83195eaf4897bdf97bfd84c919a5b76c991c687f9ef520ebfa037
MD5 58e423a5d137477c05f5c26c9cc97102
SHA1 9da438b4d4ec911330bd4e6df395fe403f1ba169
SHA512 27c083a8bb5a46d30033dcbc1229dd62833543fc9225b4a53d84a869c56f184aeca6dae352154db5c04e9b48e19ee82f137c0c19785e777ff988f4f846776db9
SSDEEP 49152:RWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKjCS4g0djtLhVR:J0zuNI9L4/dxL/R
TLSH
T103A57B3DA2BC00A8D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a16b3b2ba30451b81d4865c54724a6e6ddad713cd51da2c3c31858ce80d54b1
MD5 ccf809d09560b5f8415bda5964da5a20
SHA1 20b7599d1f1fc7d0dc654e94dad789466e19b55d
SHA512 644e8c2a8036d801e892a637a9af0744c607e995492b75c78b16f0a2a01346371cf3f4406fc00f3ffc31c9f3cadf3a62b02ba70b413fc62dca1590e2a84f25be
SSDEEP 24576:X1QT7EcpfxR+N5AWAz3ooiYtjMqbbqAC/PT+S1g0xHnxC4bZtxoEgmK0:qTDxR+N5YzTfjMaCS4g0djtLhVR
TLSH
T1CC55B02EA7F815E9D17E85788A23C512FA727861033193CF42A0C17E1E7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-164-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/536-75-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/536-69-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/620-261-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/620-267-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/620-262-0x0000000000640000-0x00000000006A6000-memory.dmp

Download

memory/620-319-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/1044-257-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1044-251-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/1044-315-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/1044-247-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/1308-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1308-414-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1988-23-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1988-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1988-22-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1988-16-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1988-229-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/2200-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2200-432-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2404-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2404-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2524-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2524-228-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2712-448-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-445-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-452-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-453-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-454-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-455-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-456-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-457-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-451-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-450-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-449-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-433-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-434-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-435-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-436-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-437-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-438-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-439-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-440-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-441-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-442-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-443-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-444-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-446-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-447-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-422-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-423-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-425-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-426-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-429-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-430-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-428-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-427-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-424-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-421-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-418-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-419-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-420-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-417-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-416-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2712-415-0x0000019FAEC50000-0x0000019FAEC60000-memory.dmp

Download

memory/2960-308-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2960-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3180-243-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3180-311-0x0000000140000000-0x0000000140185000-memory.dmp

Download

memory/3192-304-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3192-413-0x0000000140000000-0x00000001401AE000-memory.dmp

Download

memory/3204-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3204-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3204-288-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3204-282-0x0000000000600000-0x0000000000660000-memory.dmp

Download

memory/3396-471-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3396-324-0x0000000140000000-0x0000000140192000-memory.dmp

Download

memory/3796-271-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3796-323-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/3844-55-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3844-67-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3844-65-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3844-61-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4364-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4364-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4364-231-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4364-163-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4368-295-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4368-407-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4368-300-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/4368-293-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/4408-278-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4408-402-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/4544-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4544-403-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4544-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4772-8-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4772-30-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x00000000005A0000-memory.dmp

Download

memory/4772-1-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4892-42-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4892-230-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4892-33-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4892-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-241-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5116-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5116-368-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5116-400-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5116-384-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5116-411-0x000000000CD70000-0x000000000CD78000-memory.dmp

Download

memory/5116-482-0x0000000140000000-0x0000000140179000-memory.dmp

Download