6745a7e6c0bdb4a402d4af36b4e60119bc0424974e08bdc64969a595c42e0687

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 4.3MB
Sample261014-cbf6bsw1ev
SHA256 6745a7e6c0bdb4a402d4af36b4e60119bc0424974e08bdc64969a595c42e0687
MD5 ef07425d182a880cb0f0a594d9b092d5
SHA1 4c147bf93d6e64967048c071776682d53f94773d
SHA512 fe395a1f8b959caf780a5d3058b3b946620bdf095698397b604c51d09886a48a90cec797b1be6c5e64b91b720c87d8c5e2fa837f2ce20773af041baaaf584d61
SSDEEP 98304:hdEHEa1c7hP164hzvJny9Nctze3GFLOAkGkzdnEVomFHKnP60D527BWG:hd0EF1pDGNctze3GFLOyomFHKnPRVQBx
TLSH
T15726C0113D4C0076D11B1AB14AE9F77CF22EBE7C173610A76290B66DBDFA7814A2E427
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution ransomware spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 23 IoCs

pid	Process
4700	alg.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
4548	fxssvc.exe
2664	elevation_service.exe
5568	elevation_service.exe
1928	maintenanceservice.exe
5348	msdtc.exe
3436	OSE.EXE
5472	PerceptionSimulationService.exe
2152	perfhost.exe
2688	locator.exe
5488	SensorDataService.exe
1580	snmptrap.exe
5860	spectrum.exe
5796	ssh-agent.exe
3720	TieringEngineService.exe
2368	AgentService.exe
3836	vds.exe
4732	vssvc.exe
5360	wbengine.exe
640	WmiApSrv.exe
5896	SearchIndexer.exe
5564	YoudaoDictUninstallTemp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3a31ef1e4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5612	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	YoudaoDictUninstallTemp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	YoudaoDictUninstallTemp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YoudaoDictUninstallTemp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000aad92ec7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053b63deb7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c8d55eb7e5bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036cc12eb7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000054b402ed7e5bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f98a39ed7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbf057eb7e5bdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c57961eb7e5bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
3160	DiagnosticsHub.StandardCollector.Service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe
2664	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4584	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAuditPrivilege	4548	fxssvc.exe
Token: SeRestorePrivilege	3720	TieringEngineService.exe
Token: SeManageVolumePrivilege	3720	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2368	AgentService.exe
Token: SeBackupPrivilege	4732	vssvc.exe
Token: SeRestorePrivilege	4732	vssvc.exe
Token: SeAuditPrivilege	4732	vssvc.exe
Token: SeBackupPrivilege	5360	wbengine.exe
Token: SeRestorePrivilege	5360	wbengine.exe
Token: SeSecurityPrivilege	5360	wbengine.exe
Token: 33	5896	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5896	SearchIndexer.exe
Token: SeDebugPrivilege	3160	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2664	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4584	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
5564	YoudaoDictUninstallTemp.exe
5564	YoudaoDictUninstallTemp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 2480	5896	SearchIndexer.exe	111
PID 5896 wrote to memory of 3152	5896	SearchIndexer.exe	112
PID 4584 wrote to memory of 5612	4584	2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	115
PID 5612 wrote to memory of 5564	5612	cmd.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_ef07425d182a880cb0f0a594d9b092d5_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YouDaoDictUninstallTemp.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Users\Admin\AppData\Local\Temp\240701828\YoudaoDictUninstallTemp.exe
    "C:\Users\Admin\AppData\Local\Temp\240701828\YoudaoDictUninstallTemp.exe" -temp "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5564

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5168

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5488

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1580

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:6044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5360

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15f47f9ef371c02d6b9a1911c41b77e4ce2df7985459de53a84f96374af1e8f5
MD5 c332262f0893364b02217f3619447298
SHA1 4e7414d5877a91f2790de073328c1735dc726036
SHA512 7c998c6cbc2dd3175ed212177f6c2adeb0f83bf1cc4c8865c7cce90cd797779dee42fe0885ca2f4ce92b65d3579c8e03d89151875bc1355e7e3bd3c73acb6db3
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhDmg27RnWGj:y3q6HjBSD527BWG
TLSH
T1AFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d8b62da16855d8007f1509c0524819e499c4e0ce9896eff31a13ec3b2b834f21
MD5 2d59520013adc693c90cb09b6886cd59
SHA1 fbe186384d2a5a8219ffb2004ea594af686353c2
SHA512 7028fc21da6f99ef3365d586806b0b858b5de015c599b3e4469acbc5329a4622d52de6a38a73054d9afefd909caa378e2e8587589faef1091b748dde71e67985
SSDEEP 24576:wXYfDtczACsqjnhMgeiCl7G0nehbGZpbD:HtcrDmg27RnWGj
TLSH
T14B650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 15af01b3432ebdd1a8a2c411c46956b7935f80952ac67b854aef117332d100d4
MD5 9e787804453e207e7fca5658953285c4
SHA1 554194dd8c2f1f4cf9ce078b7e89a46a6729e712
SHA512 40ea318812b4e4f9f76fb354fc02c7667119c5289b23c91a2d07da5b44f2104bbbad1b42d7da7a6232a185450f1d36695cc66cee606f2a8ed78cbbb39908b31d
SSDEEP 24576:80Le5ji0hmx5rM1sqjnhMgeiCl7G0nehbGZpbD:8Pji0AXsDmg27RnWGj
TLSH
T159859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fb7b6f91f6e2fcb0afe85a01c14023a64f4e707d99213da8ea3927c0d34f842e
MD5 a5821c3b12ce8cfb6ba381d74daa51ce
SHA1 f14638fb050ba3708a333318497482cb1cfd5c49
SHA512 de279ee27d2c0621bdab9e53b9c1ad59f53ca2c739478f6b3d42d56b40ca69e34d6b5efd069c74f85f80ad8556f02a9566a6671ab3f3cc9ef8a8e12353b35619
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWE6q8wyuHsqjnhMgeiCl7G0nehbGZpbD:G/ezSC6vUzPvxHjywDmg27RnWGj
TLSH
T104755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5a5a7953f3bb3a2b30b94886085df2a782b0644030d3e525ee91526926db14d6
MD5 0cec716c7db73107730271034c3e8d00
SHA1 460159e5f9d7bc0ebfece1bde9d29573b921951a
SHA512 c16768e3f3c9a1a271f1b753ece9dafc31f2509f34392246b3bf002e959f63dbc9edf5a7d862a92b4b40f3ce62349e81eb70d488f6540c02c13b977850e0d5e2
SSDEEP 24576:BVbqPb88hv/l+6usqjnhMgeiCl7G0nehbGZpbD:BVO88hXl+9Dmg27RnWGj
TLSH
T151559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 74e28bd1b79fce87907fa28c08fd989b6285083a9f6fd88e8747243a04d0b563
MD5 3eeb8b77cdfac0e1016879cfdc868f91
SHA1 c9592958ddcffb78dba62a9fb2b8f67af7d29d05
SHA512 b3562541746e36d139dec9f12a3a4fbaede13130b97279aebfbc6487f0247f39f555eff924ad36ff8df8389dd89e0fc4b1d271d8d9e95ade95145ce6e072c9b3
SSDEEP 12288:w5BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:w5BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1394523BE824C11CAEA7608B5C3E9F51DAC137E56982008536A637DFDE6F5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1b04ebb318d99ec1e85b2868bfd33338bccdd88a35ff945f887e7fa38608996a
MD5 d86c56c3e54df593c2a49debde66d273
SHA1 9549d9a777bfe282bc70edf1b1c7f596f475a0e0
SHA512 2c1a2272164fbfa6087b42b4b1ce90164ec5a1e940c00ca9cdaa0716e7ef59ad83949e69d270ca9b4b67d29a2c1b0447bad2c02ff7984bfea71af9dc117aa3c5
SSDEEP 12288:AeBNUbTVO86UmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:AJIUmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD65CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 392d28d424a0aa1dc981784ee48e5be8e75bda11735b88f0dc927c7da7c461af
MD5 3d90ea03fafcfc677b8d6306ccb7f553
SHA1 8f2886bc1f686dd5cceb13a201b348f694a7206d
SHA512 945271c1c3bc54f868564bdb70c91e3b1085f28bb36da3f4f81252f23b875a755f8ca0d01fa5da87d3eb55c99c4c39e060794c2ad41e8f0f42143a8e6c64a642
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THR:RQvGAdlCEL8c/yRNw5CLD527BWG
TLSH
T125266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.4MB
SHA256 210d1ce0108e248a716147a6e4030c06ec703e46f540d304a25858f02708ecaf
MD5 ed201bd08b5c42e72d59119eadafa0ac
SHA1 07b44fad233688f51f0951709db0b37a6b88163f
SHA512 e049964794c23a7e99b3f2b0ab302e4028b51d7bec68820679e54bd965fc6faa443014667d96d54949475ebbdc5c22a02190bb8d58a20aefb92a0fb0ab49720e
SSDEEP 12288:tAwSfxL/2Dc3XDLLmt0LDQewsAjgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:emewsAjgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19865E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 49cbd93676c6b20c81fc1662d9fb5d488617bbd9221f4539ecfa1082f7e13d41
MD5 731047f0353c2055eba11de5ce50930c
SHA1 352898db52a17ca27f71c55760c17da0656f7e6e
SHA512 1e3bb54064dd08bd040f0600748f17b9148a0cd9b437bbb48a9de2780f6b2de768c14b4757ac65273a0b6b9a0599efd7decce01950f3ecf6cbdb517572220b87
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHUVQBWG:2UEtQevvqc2W1cpV2EI32bB
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2ec587fbe6246c0e39f728c1540dfd4e421506f551239d88defa01ce6bd9a80b
MD5 1a4dce7fa55f76317a0405c9a96e94bd
SHA1 e6c4073de9d1bbc66050cbae95ea309bfe35b5ed
SHA512 d1a31175936d0a24f1070cd4d307ef1e9d6ceab6be909cc46f1d273e06ec4c21fb6903e93a3e38de42f2dac85abe4512bc0ab60e6898ffd0f6554e4b76347776
SSDEEP 49152:ACbRquA/m2yL5zQfFiV+XenmE3/z8Dmg27RnWGj:JoqtVjnm/D527BWG
TLSH
T14AD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 601406c111fe7143587e050d982658b2c3ebca086cb40e6591fdaa5a363b8c81
MD5 d68b473d6a7c56b08ff6e2e01f12eb59
SHA1 42cbd8d75d3afdbc0e39a31d73d98c41ce1d27ab
SHA512 566653b769caefcff6fe61d025d6835095e21a825336be55cd658a25b449058981d8f58bd09817b7cb2120dabee57c38bad1d4d84bc8fdfd8f99447b3f8f7022
SSDEEP 24576:jAhGLJIFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:jAMyFoiq5vDmg27RnWGj
TLSH
T1A9359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.3MB
SHA256 86dff41576c938e53369e5d39786532b019dfd0f8f16c9946a7861f2bf04f565
MD5 ad764b14904b2d8db83bb54a07950465
SHA1 3f86777636971951e5c730f5f98de59578d890ec
SHA512 6562d0634662803711b869a648e3cbfaaeb7f9711fc58e5962ffc2d698931668d7a07c438711795e9a09bb029c1361fcd2ed346db9b6febcbd2385b4a69b24ae
SSDEEP 12288:amw5HEjsChN8BFgl0WDm+CnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:zwuxOW0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B555F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 0697cce2afbfc38b821019a0ca53ab4bc20457c7dcd22833c864c1b39bf26ac9
MD5 2f4ed2a8e0a90a41c3ba1d12c6e4d809
SHA1 6b81470898a179f5811c6043c5fa68825e062b04
SHA512 80b0358f0024efddb94c307ac695d99fcda95e4b482f05ea04bd936cac26987336646e8931420d45e3dd17dd55f22f43721f61a4194b9c01f34572de50fd24d7
SSDEEP 12288:FZZ1IyQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZutsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74512AE239820FAE5634178C6E5D609EB333C53673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 733d8855608e0f0c7b9b8623e1baa7ec47f79ce418a10f5060a17f4344b95c34
MD5 2629115ebff8cd5a7dfc41f7ca6b9003
SHA1 2806cd3ccd53877e2a1ee6101718031763a5d2f7
SHA512 646f57e91bca642689f6604c8d91c828e8d2a0d0bbb5a3733de45b0ec00021922a8a12db6fe3fe98124297c1afe85897a36d1195d72a121eaf255fdc9c5b476e
SSDEEP 98304:tQRQyi36YOcPQLvw2gAf+PN3uD527BWG:EQyiKayX+PN+VQBWG
TLSH
T1AD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 325f7c6c7a705cc2d2074def93a621594351ba0c297bbedd5b58b5885ecce5aa
MD5 d30e5c8682b4f8017392ed77b52d2af8
SHA1 dfbb918a4418578cbafc8972af293f1a2d855b2e
SHA512 0662107d2c7a502a3f4d40759e86bf92d33042a85db5b4214e3ee9cd40b94f476ec4a19c9205df87c013ba95be7bd99f2af7f0ed12d165ffc5985690a2c5fe91
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3uD527BWG:0QyiKayX+PN+VQBWG
TLSH
T196667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c1859e5c7fd1aa3b6dd9988828078d81bdeb59bcfc7ecb0e06d1ad4d553dc55
MD5 6a1dfb1cbac331f0483800aa634c180f
SHA1 eb23e052235521d9015b9374d0e9477301690486
SHA512 804d7dff9ed7af84ba597845a36c83d7eb1ed3a80b1da8a135c6dca136556acd9360a53452a73f7937277f7f0b8a883e2794b06a4ae7983b054e79fdf1cf5269
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09sqjnhMgeiCl7Ge:T68Qg55nhheWu7PNU3/sDmg27RnWGj
TLSH
T1BEB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6815973ca4eed61dca73469e02e0b23f1558f6fe7840fa96a17a370069a4c04e
MD5 e1548f0fe16303e95e77dadc70354b06
SHA1 14454386d44255fc218be03db54258d6d06a708f
SHA512 3f6cdee18d8b1257e5239a67c52d281e33ec01a794cb7d9658ab383f719e584c78801a32406c3e2e6119695328e1fbac8acc72cb50ecdc6d1785331b62bfce93
SSDEEP 98304:ly5112gYy5azzVvL69nLKnhZVD527BWG:ILIHmWhXVQBWG
TLSH
T131167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 67129c9bdc752bc003134da330652f37f0da38c9ecab5052e7391bdffac0edab
MD5 1e8898bace69d68cf53e57af82a2c3aa
SHA1 5bdbf5b40fbf678aa3a7dffc4b433efd9e05663c
SHA512 d884ed1951e672efe62672edeed2d4f632741cea2e7fbe939035b54b4bc0965eb47bc597c5c9410e81492d2fc3ce79c2e46cc16a1e09df0eac55f931cc8461a3
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWDmg27RnWGj:Bu6JmVxd2dWD527BWG
TLSH
T1B6D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5b845e80d55989879d3b89ea743eea801b758af788f2bcc4c7fa73b0a0db9298
MD5 dd3cffdc0e2d7af8a7277cb97d88379a
SHA1 a59b8943f9d295b273061223cbe652026967d7dd
SHA512 bbff4c88805c559e70bab6101fa8ff5ea6f936ad5ac9a804b803c59829b17e57b62977c07a899f2a93412ea8ec90d01574f06db9db2207d6e86fa4893e820863
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xKDmg27RnWGj:cmifPbR/D527BWG
TLSH
T1A5B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 27b456fd62a73eec14c41ebefb65b94d8e4c5552f086a55e668a84579fa13b38
MD5 ea39f6a04ce4baf3650db0fd8ebfb2ff
SHA1 c774070e8ba02ac94a32dbd7f9d0ea2445534a25
SHA512 5f5fa0bf476f64b9d287e195a6531df9e54448dfaaf8d5c68257bb9dd3031d99ba6a81e76d8cc58d0a34173ddceaa54d8858515b0b25aeb8b8e16873c72b91d7
SSDEEP 49152:ESuZQIY0Be2KRRVtOnks6NMHqRDmg27RnWGj:W5dKTi61RD527BWG
TLSH
T122C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c09f479e06cf2c810a60cb6e9b04a141aedc8a451882ae36777515de5ecce2c4
MD5 98ce540bbee4e5b005d5afc83a2219f9
SHA1 f8fb7929e2cb1d8d2f78a893596b66775676da3b
SHA512 1c94da91c85cefea1111ee35ff0da41b3dc7f263f54795f9be1d05264620b7de33b07259b89a62a59b08e510259d8c3f0ae2ee56a1c1ffe3a49fe92b907a78bc
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wGDmg27RnWGj:IX2iyphDD527BWG
TLSH
T15495BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.1MB
SHA256 f152642f428f9cf780d1e35fbf78cf0c55a26bf6927b6fbcfd8613b4cf9a0799
MD5 60ed555c75eeca4206429fb345ebc260
SHA1 b8d56907eb47b0acb835fde46755fd1232393851
SHA512 dd914309c48dc7e6dbb5685fd420481d3c63ddcb82d042817ab7c76e5277ede91b927ab6d49818d5749f2f224b6d9ca287d08c09aa10ec0784f296e069c01afc
SSDEEP 12288:D5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE915C01CBE92248B5C3E5F15DAC173E57E92004837A5778BEFBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.1MB
SHA256 c2ddf08704f733f643a930d47133e1df1f29b684d76e60f49d6a4e3295d13de4
MD5 ba56a1443cdccc271124e28a5b71e734
SHA1 49167bf702da96b389270964089d79c359a0d124
SHA512 46f406d5b732c33d50d64ba48ece5b0906fb922260c0fce4bdf4fe7410965a444cf1010f95c732ea087179bdc126bf392c6d1019cfd23179c6502cdad282a510
SSDEEP 12288:98Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:98sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BE915C01CBE92248B5C3E5F15DAC173E57E92004837A67B8BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.1MB
SHA256 b7009bbcc384ea6ffc9796c82890163cef999c5131e0f1977e275e6a98978246
MD5 7227c72b9f2009662bf4e86d49a4983f
SHA1 29dbeb144421feaa8efe6384beda1141c4e1a33c
SHA512 3d452e578fa60dac7a6cf0f24b5f9ca214ffac7443a0cc216382c0b4eebfd5469f70a089a673811d7bc1a93a7c8df6278c9c2a811a0778df07ae08742900348a
SSDEEP 12288:h+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A04523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA9778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.1MB
SHA256 e8953859014057c4c3a483e43d31d6ec93ea1f1cd40aa8c96b8de91a4d47003e
MD5 428a67900f3606295f7d11ad974fc573
SHA1 62e6ab6e7129d69df44041aabd95c9ae11035963
SHA512 381006917ee53d8e7b9beb3bf382086ebc8a6dc12fd3697a2906ce15d698f14687470cdd5df9829e3a1e6ae45b3fc75ffc57c9ea0f112fd139ba8a7eca9adfa4
SSDEEP 12288:DVLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A045236E535C01C6D83285B5C2E5E11DE8237D97EB3005DB6B532CBE9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.1MB
SHA256 c1aba850ab68c54c45d5fc33e96e731b4825ee916c961a92697e96190b86ec71
MD5 1af0be6305291c2d54004402f57ac5bc
SHA1 628b02c58c6a2cb63ed796234fa4b9f26869abc0
SHA512 08ff667dfd2509bf4b58dad3aadb8a92c2c29aaa17647486d23a0b23856fd5fe72e8aeb77c1cb1f75586fb2a61c3d2772099bf37c1727bc1fe40c14612a3f58e
SSDEEP 12288:qzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C34523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA5778BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.1MB
SHA256 8b1eaf55252c758753ac5486ffc5cee8d39ecff282f9fe66f4c70fab1ccb6425
MD5 2873d1888bff924cd7038b2f3dd611ae
SHA1 14d77de727227895959251b8a7950f6d36c3d9de
SHA512 5dbdb841da28e824feeab529445f7ca8772692bd49a0e84a6c55c5d3c5dba1c875184e8ca0475e8908ecdc3bbc9dafff6d625a41b3abc32e3313982d1eb9ff56
SSDEEP 12288:2YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1034523BE915C01CBE92648B5C3E5F14DAC073E57E92004837B97B8BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.1MB
SHA256 a91ee52836f5bcf6ae9cd01b62c40289cf515b6615e7f3c1f466fe748c0ffc75
MD5 ca04eec6c733255abe5ab3101d9e6343
SHA1 832f3028472290f5fd8ba8d535d56f64d9e06886
SHA512 9490ca217c2730b923ecfbcae1b1ae0a21014c8598a3b76c79e2cc75efd22821e112eeebd1144859c42d0917acabf5606d0e873a21b3ffd8a46503a32b602fab
SSDEEP 12288:VEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F34523BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BB67B8B9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7b852f8c391cae4eff1601e1cff4b83607e6ea91f641f85b217243d3b61bb035
MD5 b84d4d536dbe09e370cf201ecb92e419
SHA1 c8169d05783eee512a3dfc1a69683a4607c1d383
SHA512 78bee5455cb37c2db16edc9b4560b7aee8d965316fe259036145fb3b1cf6945c9890316d59de95d83dee24d39b1eb091caae549d807936bf78165d00841dcd09
SSDEEP 24576:iZMhzFVSOcsqjnhMgeiCl7G0nehbGZpbD:iZMhzf0Dmg27RnWGj
TLSH
T1FA6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.1MB
SHA256 bb70ff71c03fca1b4b93d0cb4331d8151343e196a002c48ff03ca0000235f4d8
MD5 68277e52aadfe543eb38a7251a0377dd
SHA1 07205e6065855f402e8a7491db02394032635bd8
SHA512 3a6d4c00261adfec2c714ca28bbb6c6ecf1acb0d1110cfb5de6e5c933717c917a2ebdffa0e56e1bda7b2510b5313b977dcad46ee858a43f7765fcd4a467c42f3
SSDEEP 12288:6dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6dsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA4523BE915C01CAE92608B5C3E5F15DAC173E5BE9200483BA5B78BDF7F24684B3D426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.1MB
SHA256 b9e6d71224e6faada082f5e49fe415ec7f58cbd2a8fa729a2c86abdf484364e9
MD5 1965461caa6265cac0de1109dd8a1ad7
SHA1 ea1cdf02ac11b58ec3fcee5f176915ba209f1298
SHA512 b41f889e41f0ddf4141042209fd0006b4018b3ef3ba94a0130b806a6ec718851546dc391d4b7e98ce7d3a6b92fadad47ac41e20bb1c8603c2748c417a8a0d802
SSDEEP 12288:jxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D94523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA5BB8BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.2MB
SHA256 a8276d4160d2010d67eea7bf9eb7f6ca7b25a9f8d095781a2448419f5e4c7c9f
MD5 1dc8794b94d4d048e11d9eb24af65638
SHA1 1ab92ccd0888767d5f569437eb8df230dba056d2
SHA512 f0a45ac5c86a0f7bc38b9f7eadd6fca55bae37ce14fafd417545f4627d43cb6552aacb167300ee5c46c80351a3d59d7e1b47c126a6a3d509870c37c7b7619c41
SSDEEP 12288:hyPz5L8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wzyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC55025B73A530F9D1378178C5A29A06F7337C3247204A9F17A156BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.1MB
SHA256 05e06d319546786b865819bd9aced9e0ac3ca0e69e3b8a12c097bb81b11490d1
MD5 a373e897923c5d1618660f540ef5f570
SHA1 7400f734049c6439ff4b34c1ce82c841ecc5b7d1
SHA512 e9344f828920e5dd9eccda1de0f3496e78fbbac4fa4e436ea6758e8e915e31597514b211992abd1b0f59f109530c9357680e19d7b6d227043b991d348e4f2ca3
SSDEEP 12288:ydXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ydsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE915C01CAE92608B5C3E5F15DAC173E5BE9200483BA5778BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.1MB
SHA256 03d1ba55448c839bf427e6e5ab8ebd6dd2a6ade77fcfc2d8f2bc6bcaf8b52e08
MD5 61efd60d68dc7a88a335f9bbb60f94a5
SHA1 3d8504af4866f694a3f52e6ef96d9255bd211d9a
SHA512 010adca75ab10c058d747d153a7040c1048da30859aa76ec9fcba4fcd32bdf4ae97317eb138e588c43289ab13d0a64f268b7dc186061f84755f5c2c8a45a5888
SSDEEP 12288:hdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1844523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.2MB
SHA256 24db47eb57cdd3916677b2a214843e24e34f4ca1b8b8642575281e34ce691e94
MD5 b9426da365ffa3500878631822f8c2c3
SHA1 5dc252ab5b20dfd7982dd76ee347cb3c3d18193d
SHA512 ef6d4e60032701c7431024cbb7985769aeab3e02df4b0cede40ded7bb3d3331ad0cc5df6f97495d314252e5adb053967e162ca4c63c8d74e8636e6e895b6cae9
SSDEEP 12288:0yPz5L8QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzyQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE55025B73A530F9D1368138C5A29A06F7337C3647204A9F17A156BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ef3ed9f7852520df9a17d8e9fd2a02320aa202ac033296477a94cf95902209a7
MD5 50e787d3131f1dbff070ac3d513aa545
SHA1 7647ca60dd6c418ce94abd597afdabe47354f1c4
SHA512 d8d520e778acab5876723d8305490372f5ace6628f4fed472fe2fb46b16c1f2d58176e56075305408ebaa27c0cd562c2cf91b2718b4be72d535288f8c851c68e
SSDEEP 24576:tTCaLl3z0zDOsqjnhMgeiCl7G0nehbGZpbD:tTZLljbDmg27RnWGj
TLSH
T1926501A9B35018F8EC67813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 79bac8876c46eea8fa8c86444fdf92679adc35ba0344248771e49f9693e3b6a0
MD5 26ce7ecbb05bcd37ad351b7863916776
SHA1 fad15a45b00a278ed81724676592f8a7e140153d
SHA512 0b2bd1b5ccbced2ef04fa4bee15e8b75cdf48f2a56381f6fd2ca2144c0bee09dc47e7a1d96906aeaf61a4e897a0febdb2f4c47409eb9161168621b81d4591055
SSDEEP 24576:WcP4mcvIjkGOxhKP2l71nNKbrh/8KBFsqjnhMgeiCl7G0nehbGZpbD:xP4m4IpOO67W8KLDmg27RnWGj
TLSH
T1D165BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.2MB
SHA256 3b7896c0cb72a0a51160896c1c66738ba789f88147a2fc924ed8d615b52638b4
MD5 03e48d5fa9575f617b506bd8b492d610
SHA1 a0ca535f0869253006e12e105427d207031e8e4d
SHA512 14e404fcb1f2357a351f287c4633bec7933652b22b11972c10557a5d0a31e1ea0ec6310a46e8875d36b1c9505a83b52ba9129492f3ff14942cee28535ba7a858
SSDEEP 12288:JysftXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE55015AD29802D8C06E5179C3969605F7333C2687E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.1MB
SHA256 8731e6c27c34eb0590cf8725799443dc78ccfa6462447982352bae18ebef6f96
MD5 71ebf1a011c8b730bf558f2086448977
SHA1 debdde127353b8432a2065e4382bbac994dff8f0
SHA512 5cfa654a82696bc01f3096b8ca4a50aab9fb4013460707f2723a811101ad1761d80d2248a0efe01fed9d6334cfc8d039efd1d5730387f141618ea4dcc5fd91fd
SSDEEP 12288:9NXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9NsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD45237EC34C118BE97659B082E5E12D781B3E669E200483B95778FDF6F18A48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 55010b3c069b9519b408e694c718970c55cec4224bcb7c5d4738938ea344f18d
MD5 484bacf3de3c0d5ca9d55cf95a0aff8e
SHA1 c8392f8799f61fbbf8c8d314ae39111115f5515a
SHA512 dff13f7545e88a094d68e758120ba6c89e9a5d3a59eb70f59d3ceb855e51baeada752739a71780cc02bba4d6facccf6036f0ef6ba3b7b1aeb158f181ba3a48c2
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQ3Dmg27RnWGj:Xa0hNYG4JwUD527BWG
TLSH
T10585AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 9e850fe5960a282b63ad68979acf8d6b6611bdd488a150cafd3f5ff59de1a1c8
MD5 385120ca0dad99333e88d20ce30daf68
SHA1 9f607039728baa4337f1e438ac186980eeb7fdce
SHA512 bab105ff9d1cdda5fc07fdb407fbd4a057bed79f07df957f6a768e5117685e0841dc4608259a888d43cbdb871dad3a7adb981332641a17044bcb1a713a75731e
SSDEEP 12288:hhbHjfXMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hhbHjPMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4512BE12AC20D9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 3a4a89af620d7dc12575fd46af9731708ca594c22688bfa53d29b86c1fab1634
MD5 79e2c064706e987cd5f746aef519bfc8
SHA1 8156355b948c8294aa7ab42f6f2462dde2c06515
SHA512 de7776ea355be61006a7aa1ec3d22da13606c34f079351bb87ed0c55ec94925c01da0d6b65c0dc9d1b7594ab283ed6d99bbff9442fcc3e2529e9dd0c4b1db862
SSDEEP 24576:y3YgnJcRTk4yti+R5dBR/0sqjnhMgeiCl7G0nehbGZpbD:yIgnaTk46pBR/QDmg27RnWGj
TLSH
T10045BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.1MB
SHA256 2a1b9b870e0fce19fcaf2cfaed119d951925fdee4ad6bc6bbb6dbb023dd9c387
MD5 2e909682e2777f3b03ad787f03c45498
SHA1 76bec383458a1be80859fcbb34cba86e4d3a5b1e
SHA512 61c83772011201405dd47632f5aa78c3a89a661e603a33f77ecdbb93699b02070fd9a119f0b42c1f7c046b2d142cf2adee9dc20bcea66fcf6eacc4a143bd081f
SSDEEP 12288:0hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1383523BE924C11CAD93649B5C3E5E11DA8073E56AB2004D37967B8FDE7F28E84B39413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 87b7368c042b0a63ea0747bee90bf3f369d56ce1f92ebe6d75af2949d45acf69
MD5 b931a195ff407012bffeea77e0e813ff
SHA1 fb2f5d481e0c28811beaba3a65c69b51d56cd1a7
SHA512 383dbe0863206f30d6d36706139443c84e0f05cd3c115d60d34633e963e19a58cc67ffb10ac65f6f68ec3112ee167b8e29bc79a6be67550a0f98df129e174a83
SSDEEP 12288:5ObGA4LWOsvAYFTCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:uWL3UTCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T166650159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.2MB
SHA256 52aac5a90170eb02c2daff0cbe68f15ed3268c02f17db806b3f2169ecb88106f
MD5 18e0ea15a0fd7623f59a151c318211fb
SHA1 34cdfa0b22dddfc44b831d52ed3db251409640f0
SHA512 78a566e3a7faa312d442e54e4bdcb90357c9a2ce8e28285fc3312f92e0483006d8ff81def262c10e886f15e8890bc809d5079f052b746da279abb8aa1d145508
SSDEEP 12288:kpFtIOGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TOGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A245026E32DC10E9E536917D8692D20DD6327C661B2117DF06D180BE5FB3EF84D3AA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fc54425b28a97b4207b9a23a8d7647573386e4b68b596f92d3ff6b10ec932889
MD5 96e9a0205a872fd3c6dc69a52efcea8a
SHA1 c384571ec7631a1e4551c3aceac28124c7b98c1e
SHA512 66d0734ed64d3dda49ba2286e9cd3be7d37af2378feaac03b6525120c319da3164bed122d757d180b3c86f66b40fe7f19c72b149550ce72f43da8e3d253670d9
SSDEEP 24576:A7NM9YqZqmWMUkPjZM48Mv6bEhsdsqjnhMgeiCl7G0nehbGZpbD:A7cBWMpPjN8DbEhYDmg27RnWGj
TLSH
T147659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f9e5963464217728269f51f0d2366d489de2b44f1533e7424a3828b3b9730e04
MD5 3dddd9ea63e14382355984a6efe7c77b
SHA1 a828ec0ad5791b08be86450e26809f9bbc8995c6
SHA512 08c50918db77b80a994ffa5a4e68215fa6c323222d5db35a246861ba4cb446f1619741f57ca6c859520fbbb50c013d06bea28e217586138024d389290b76ac7c
SSDEEP 24576:tW6BApg2YuyuNDYTabvcdvNYf8km1vsqjnhMgeiCl7G0nehbGZpbD:tF2YuHNETovAvNYf8kmhDmg27RnWGj
TLSH
T15E857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 fa000ca3241d3dfcd838f78c2b4d4cee9dafd4db5e7f7240f92e74c60f8919fb
MD5 f2d2eec8f460fbfd387a0d9e7acfd5b4
SHA1 81bc9bddbf84d8a40221a86aa6b89957213fb0dc
SHA512 681aba85b95abdab4eea202c0aa0185f3ad9e6bb003ff8efd2e9da9b1688ab3236767d2eb67a8dceffd655523830e2ab0876cfecc3a8bb9c6622148d07bcf59a
SSDEEP 24576:EAFs06+Omlf3NXEbTo6sqjnhMgeiCl7G0nehbGZpbD:JFs060lVXuXDmg27RnWGj
TLSH
T18C65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.4MB
SHA256 482b8c88137028663f39120ead2ce6af3577e8bde82af06338b97312ddeb73ad
MD5 bcf83348146af13ec7212d2c80ef9fed
SHA1 f452eebd90dbcd0386462b75d2fed8814c4009a9
SHA512 804c20172d68cb26e382936bf60eed10fd8f3c4540f9ca9512e902e91313b0c69dd9319edf02d1f572d565d4803e17bbbef63d140a6345741b6cadae3fd69afd
SSDEEP 24576:kJnJ5D3WETsqjnhMgeiCl7G0nehbGZpbD:kJnJ5DGEXDmg27RnWGj
TLSH
T18865E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b5d6a0632336fe978fecc7d954e737b1aef91a5eb74b38ca6f4a3ca7bc12cf36
MD5 3a302fe70841d792ffd613de8b9dccb9
SHA1 4b06f85f3ddc2c688c2a51abdcca334d2ef52ac5
SHA512 16ca170597cf71b0a4b24542980d4171399fc5e095db975737e4122ff31789a1cb72a879a175ee8fa53a05f51b7619a3d47802afd3b9032e41a17e58482b5616
SSDEEP 24576:zEPghm6/7IIXdwcXrif7qQncjlP65i3Vu0sqjnhMgeiCl7G0nehbGZpbD:0g06DIKdwc+eQnSt65aV9Dmg27RnWGj
TLSH
T158955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.2MB
SHA256 725c435bc52b14623bec940c630111cde54c33c8a3aecc62421bd749822e3a40
MD5 980cf47f17f6dd1002227e27b7d06200
SHA1 60ccacace75cf618e09cb24f844d49926e08737f
SHA512 061362bd3e8e6403be653c10c9877c5284a42d7f1ed21a89aecc41d328017f75d60ce27bd1a820c8f40f16a29c0ad988eda767dd78d7addec2e3149cc35c013e
SSDEEP 12288:OEP3RYnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tYnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD4512AE679C60DAD536907D8291C209D733F4716B2127EF6692C17E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 dcd9f962b0e45601a0b516f3ee3b3b6e0df473acd9f1732143031cfeb1047b79
MD5 30ad52d912800d34743cd3a5663e2bb6
SHA1 38bd81f17e7059df4276790199e5e33a6ce123dd
SHA512 bde64fe1446cbf0317b148a787a9fd0f0f753498f6546c3db9f7ba5ea189a67670bc0ad7d17940af2b93c406dddbe8e20745823f2f033b6da30ca0caa9b303a6
SSDEEP 12288:cjky8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cIy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T178551259639C50C9E9760578C6B3D1589C32BC21AF2006DF6191FA3EAF73AE48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.1MB
SHA256 fa71cfd739930a94ff3c3983cb1d53f9479ad3047de422313fca733d349cf583
MD5 59a6d352287eafcb38521f419839e193
SHA1 2c39d6ad4f344c3df828fc59d034858fa03df39d
SHA512 e9a031de6ab94fe53e62ac226d480974b57f0acc29c472e58fa36def9098e5b8ac2f1ca3224a33aefee4ce11e3186310938970779c688df6affea071f31abeb1
SSDEEP 12288:3q2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:62sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B94523BD525C21CAE93245B4C3E5E61DA8233D366B2014E779E3F8BDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 efba990298153c6a7eef1e147a487d926d6877dcc7b13d0047da0a6580de8800
MD5 527fe2bbf97d47fb0674a5a38921f2c3
SHA1 bc96daa7ed72067028e728a06d1282505a52313c
SHA512 6e91c2031a680f7038d4f326c68201948784594d96750092305ef34e2d72663f6c6977ba9c1115eb7ad9af111c477b40e4b6a20763fdfbc4b316bef25835e0fb
SSDEEP 24576:JQ9MxZKdcz9dw3VsqjnhMgeiCl7G0nehbGZpbD:JVKZJDmg27RnWGj
TLSH
T141558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.3MB
SHA256 2dd51c5f9e9950f2fbbe3a7f478460e11fe00fb62134355909623604af2ca89b
MD5 fc152024b9b5a119c29cfe2aef79442d
SHA1 7abe5318769c5932f6b6ec501926469af1af8d4c
SHA512 e3ac08671bf4716965eb8960478c9ad0eb1382da560ce01df81af45f4854f0fd330036e7aaa1ef2b529c0dc66076895cc221b2369c6a671abb30a10f6db8e894
SSDEEP 12288:yyoKo2eRple9pgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:yyoc0ApgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14655E01FB76D40E2E176813C8985C249E673B4315B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8e0bbde1397b2f01d4c8d580104f9792cf239e83a052518400fb730402104c9f
MD5 86a3b2511bf73a014d00374b1d91d35d
SHA1 4fa740edf3ebcc194e333fc8b04b9697e20accd8
SHA512 057b5f44dd431f65238c7c11e2f195351f1f20eccfc530e79719fbffee9823ba6bb3953dd572506a93766963fb12d25a38e8ea2bb37ac54a46ca13ecd67de9fb
SSDEEP 49152:DWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKcDmg27RnWGj:D0zuNIGD527BWG
TLSH
T1EBA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e62d357b2f15bbfedd7ded5c28bf44711efe40c6e0cd1149185e7583f5361a5b
MD5 a4a02b73b02b8abb3bbe73a47c96f340
SHA1 613607824a607533b3f6542e767b21cdfc883de8
SHA512 733e401bd12b5c55042ca0802afbf65e5252c1f8cef888c9c82d18f82ba5fc8e9a36ee28970af5069da32e91389469693e58c24b1a6985fa43cc699a5f5cdc09
SSDEEP 24576:v1QT7EcpfxR+N5AWAz3ooiYtjMqbnsqjnhMgeiCl7G0nehbGZpbD:STDxR+N5YzTfjMqDmg27RnWGj
TLSH
T1D855B02EA7F815E9D17E85798B23C516FA727821033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.4MB
SHA256 155fa6d9221dc623975176928cdae9a76fa99bb94f2387bbf4d9c2f2257f7ec0
MD5 96876061633b09101a4826d1e0655cda
SHA1 1bca8eca436f6b4ff484133e8e719224fe23a04c
SHA512 b19ef00dbd220ea60a08af75ce7b86ba54e054ad177be6d3f6c9aee447c9a0ee51036de3a0d9679cc7ef10bfccabf70b77662b956ae155a46f6433342d235552
SSDEEP 24576:kTMdOz0FFS+PmSLLsqjnhMgeiCl7G0nehbGZpbD:M0K+PmSL/Dmg27RnWGj
TLSH
T1E065E17EA36D14E5E47BC17DC653D90AE9733862032166DB0690C0B97FA7EE46A3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 8f0c0213a305c9d7753f3865f0b110feff1d9e36d55286a55dc2a00be2be7969
MD5 ac6d70cdbae43db9ee37897ec10a3839
SHA1 47755780373d6068db565d07334d24d5d31d77b1
SHA512 2cb07884356a0e63859fce6e8dfaf07c85ce0a521ea7555fd024d4ddea63f18fbbf1cc5cb7e8450407e0e2c988acd53fc7ddddb4940ef80eeaf9d2ceb4d4b646
SSDEEP 12288:k4dCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F045126D53EC20D9E8325574C3A6D11998327C36272019FF39E2D9BE9F739D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-544-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/640-219-0x0000000140000000-0x0000000140151000-memory.dmp

Download

memory/1580-212-0x0000000140000000-0x0000000140121000-memory.dmp

Download

memory/1928-66-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/1928-54-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/1928-60-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/1928-64-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2152-209-0x0000000000400000-0x0000000000522000-memory.dmp

Download

memory/2152-94-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/2152-99-0x00000000007A0000-0x0000000000807000-memory.dmp

Download

memory/2368-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2664-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2664-447-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2664-38-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2664-32-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/2688-210-0x0000000140000000-0x0000000140120000-memory.dmp

Download

memory/3152-445-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-423-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-451-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-454-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-452-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-453-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-448-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-450-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-449-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-414-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-415-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-416-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-417-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-418-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-419-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-420-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-421-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-422-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-424-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-425-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-426-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-427-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-430-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-431-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-432-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-433-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-434-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-435-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-436-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-437-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-438-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-439-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-440-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-441-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-442-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-443-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-444-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-428-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3152-429-0x0000025FEAA20000-0x0000025FEAA30000-memory.dmp

Download

memory/3160-16-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3160-25-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3160-17-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/3160-409-0x0000000140000000-0x0000000140134000-memory.dmp

Download

memory/3436-77-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3436-71-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/3436-191-0x0000000140000000-0x000000014015A000-memory.dmp

Download

memory/3720-215-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/3836-216-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4548-42-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4548-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4584-279-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/4584-5-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/4584-365-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/4584-8-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/4584-0-0x0000000002610000-0x0000000002677000-memory.dmp

Download

memory/4700-13-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4700-371-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4732-217-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5348-222-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/5360-218-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5472-207-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/5472-81-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5472-87-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/5488-211-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5488-382-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5564-410-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/5564-404-0x0000000000990000-0x00000000009F7000-memory.dmp

Download

memory/5564-446-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/5568-221-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5568-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5568-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5796-121-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5796-127-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5796-214-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/5860-116-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5860-110-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5860-213-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5896-159-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5896-220-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5896-386-0x000000000CD30000-0x000000000CD38000-memory.dmp

Download

memory/5896-175-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5896-545-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5896-194-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download