0bc2bb68b131900fca6867ef98e3e9b9d825bb987e7dd0dc77da95e6d0ea5443

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample261024-vramlabs2v
SHA256 0bc2bb68b131900fca6867ef98e3e9b9d825bb987e7dd0dc77da95e6d0ea5443
MD5 3324afe910be95102f426893ee93c3b3
SHA1 c746a70c7d025d6b32b0265a7281a5b6315d216c
SHA512 2ebcd51a871267117675bac873a11190b159f7a3af306c2f7ad83ca17736db199b31e99e8a280a97a0ddcaa49c37c2f15974d65517e3e3efb8cc8680f2c63427
SSDEEP 24576:ij/QugDwp7wkt8bk+ks+Vvwn3sqjnhMgeiCl7G0nehbGZpbD:SXp7wkt84+kjVvwnLDmg27RnWGj
TLSH
T18375E021BAF6C077D87201304EB9E625646EB8314F7189CB73E45A2D5F356D18B32BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1200	alg.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
1120	elevation_service.exe
2316	elevation_service.exe
4280	maintenanceservice.exe
4716	OSE.EXE
3740	fxssvc.exe
3156	msdtc.exe
4444	PerceptionSimulationService.exe
2860	perfhost.exe
2224	locator.exe
5032	SensorDataService.exe
2608	snmptrap.exe
1664	spectrum.exe
1252	ssh-agent.exe
2864	TieringEngineService.exe
2408	AgentService.exe
1332	vds.exe
2776	vssvc.exe
4420	wbengine.exe
3136	WmiApSrv.exe
4208	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f605a2739b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd5d9326db63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000716a4127db63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f554d27db63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009196cc26db63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004132e926db63dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020922927db63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000719b6f26db63dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dce2427db63dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
3372	DiagnosticsHub.StandardCollector.Service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe
1120	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1804	2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3372	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1120	elevation_service.exe
Token: SeAuditPrivilege	3740	fxssvc.exe
Token: SeRestorePrivilege	2864	TieringEngineService.exe
Token: SeManageVolumePrivilege	2864	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2408	AgentService.exe
Token: SeBackupPrivilege	2776	vssvc.exe
Token: SeRestorePrivilege	2776	vssvc.exe
Token: SeAuditPrivilege	2776	vssvc.exe
Token: SeBackupPrivilege	4420	wbengine.exe
Token: SeRestorePrivilege	4420	wbengine.exe
Token: SeSecurityPrivilege	4420	wbengine.exe
Token: 33	4208	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4208	SearchIndexer.exe
Token: SeDebugPrivilege	1120	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4992	4208	SearchIndexer.exe	119
PID 4208 wrote to memory of 4256	4208	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3324afe910be95102f426893ee93c3b3_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1804

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2316

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5012

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5032

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2608

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1664

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1332

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bedcda148888a7c20722fbfcdf3dcd15c65eb51ebf8db423d9a46ee4dcc0e923
MD5 00dfdf2a7521cba5969937d8fbbc6bcf
SHA1 5640b0d75f585b30894b4bf4535c9398a97e3534
SHA512 302d89fe7dc627352da8d6b65f29bb55f04ab7017e02a60c87a8de7e661598b4e6486b42b2cea0534517576e23dec6a1bcb4fed3aaada680c642602c808091be
SSDEEP 49152:Ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7Dmg27RnWGj:i3q6HjBUD527BWG
TLSH
T194D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5b62508b01b9705dda03c132aa8ce5778575e5e68f7f46ffb53480f3e3fb2b05
MD5 6c6f2a1fc65f8b5baf68e14323f9b817
SHA1 03dc1dfd7f0582749e22186c29997eb30adf1aff
SHA512 94eb690bbcaadc7c532e2f89a65e6e0d4d703010f37462a7bd737eceb6f8d545ee84662cb5c89bb4ed5cf2277bf78b4ad6aa0511cbffc13b908b67e3cfd6133b
SSDEEP 24576:xXYfDtczAssqjnhMgeiCl7G0nehbGZpbD:UtcpDmg27RnWGj
TLSH
T103650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2d04720fd9f0a58d94189d4b41af4dc149fe8eb81c04ea1df207569305ab3611
MD5 42bcf1ac40948c0117e87cd01b4f037a
SHA1 37ff8575fa330c0837b6422ad850db478983ad70
SHA512 8862c1706f8e497c6892cedae75b6ad127240c499763cdd14835d961d119a9570ea3d6cc39636575675dcaf530b4b74638e96059029d0028fbcd14f3daa5b41d
SSDEEP 24576:V0Le5ji0hmxirMvsqjnhMgeiCl7G0nehbGZpbD:VPji0AcSDmg27RnWGj
TLSH
T117859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 745c979238cce2c8326d685c466ae2e0ab1e416df4e0007633194d23cf86bb39
MD5 42c63490f7ed8955e2369f4e9ff75389
SHA1 1a82d3486a5da082b0648a94c61d48f889909b95
SHA512 1b9f6df8663faa85f7c0583012dd3afd218c1b15160c24dfcdb133fe0cf30d34947741ccd5115bdad7234c07b68ff1a6e14dbb07cd1ea9b865fa38d7cb3fdd7a
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWE6q8wyuFsqjnhMgeiCl7G0nehbGZpbD:r/ezSC6vUzPvxHjyWDmg27RnWGj
TLSH
T172755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 163795c7a839bd57fc489e63d57a90af062681a221e3773063312af1c8a1fc6a
MD5 9bea439d7340c23bcc4cce5a0ed1d341
SHA1 df0ded2c9548659b72cb7d412f05fc956a352921
SHA512 d209f9cb3cf958d82da0aead605d8b38abfd346806c5c2d3e253639b7bbf6c9531ef8a87fd45faafd46a073865c3a71e6ce1f060118e4e5a4af873f43f2b54e9
SSDEEP 24576:UVbqPb88hv/l+64sqjnhMgeiCl7G0nehbGZpbD:UVO88hXl+nDmg27RnWGj
TLSH
T165559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7e207d7081f821cf3ced25476286de66c571777308d95f9d12062261438bdf6d
MD5 0ab1ae7306cd6bbb5ab9c21d3506b03e
SHA1 2645a7d4479cf2b1436bad48c10dc05455b4b1b0
SHA512 437307223c4608c5c697c901c22609dc10413ba769b5269726a3da5e62b902454cb711944365dbe06bbd9122d987596eabd1722bad46a9f2421e03c02dc4c7b2
SSDEEP 12288:vR7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vR7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 83d3d6faa6727795dee226ddcb1b41136ed01beed77990c7912d87c4f64b2ba8
MD5 b12b2092f7d5fa41eb8960bd15c65221
SHA1 fe5c91c75c8178eeee797782e05e9d48cff41a4f
SHA512 0feb149593ff8a358bd54f5089428bd0eeca9e0eec36427b6f991b4048863decd71ad77b3eaf647a152457754e78e3b7b3e41003b603d23259ea6bfb8640e815
SSDEEP 12288:YeBNUbTVO86UAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:YJIUAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C265CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b25d550c45b7cb042012e43d5ef940f31c66634cb4432d8f9b8c94fb7cc70cc8
MD5 3e4ede2a8b1ad712baef0dddcf6c7057
SHA1 609b88ba4163f34207371b9dd406f4452e54c3fe
SHA512 0876b434555968e6c8ce8174433fdcde120a6377f335e20bdeb5f2e38c10a1c114276b4d44a96cf4ce59c04fd79df459b27e6efe0d0fa353b88f08c828142818
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:LQvGAdlCEL8c/yRNw5CJD527BWG
TLSH
T1C0266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 df285aa9e84b9329f3cba2767fd5319b451eeb169b2eccc8e7a0bee3e6942124
MD5 d18917e088e34ca844ea3cfe0ed6a487
SHA1 efa10024070be9ced829b3e5419f488ba30b75a9
SHA512 1da53b93cd1664d29c0234e86e8c83928944ef2c83f8b4e842ca5b5c48de22ec51207dfada7041b76e958731e1e213ee846ced288968cda6ebe497e8019d7fce
SSDEEP 12288:nAwSfxL/2Dc34DLLmt0LDQewsAjOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:AdewsAjOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12975E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ee48723f6fd603fb179c2e5472e707400112a21f0437b8c5d1aa7f1b09f87ff
MD5 b4db6643868ddb42568f60a9f3ea2660
SHA1 71a1c375ef9ace6b1f19325a66a8bcc4380ea9f7
SHA512 cb9e7691fc23ed3b3ae193d45d3ffe58397272a0a0ef7a96544b33005c00859902dd348c3b064bf248c76956fa580b332f87e1ed974b73551550f4945bf2461f
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqVQBWG:HUEtQevvqc2W1cpV2EI329B
TLSH
T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a793f01314157cc17a48db6400bfdee586605c110d7fe30402c1e8d150aacf77
MD5 e6ddd70cc7671326f2041768fa55732c
SHA1 0cb4a4dd1a54270617c359035709cb3330daf1af
SHA512 6761f32e3517748af5721e5e515b7bc5f79bfa7819919a85b7a4b88300baeebfaf3fe6ee6dd8dd42fac02507eceb4e9ae1ce7ef58577e28df6879787469749e4
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zCDmg27RnWGj:1oqtVjnmND527BWG
TLSH
T1B8D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d79cc3f8df4fef9467d146d7f97559cac32ffa78bd962f7317d0f2a0920d149c
MD5 ed502c89b5a07d7c3b9b393378679289
SHA1 7be6ff9d4c1ddc812102b02689ba62028a6fb195
SHA512 be00ebed64d66f38a63fa4dcb39a381a33499ec37491856ac27aeda49f25851b5a7b99c65c082331c7d126d9c0cdc49f89a23951abbd72c6aeaff0db3ea17ed5
SSDEEP 24576:UAhGLJIFoiwtA5l7S53psqjnhMgeiCl7G0nehbGZpbD:UAMyFoiq5dDmg27RnWGj
TLSH
T157359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8aa42fb8e26c45e687b4e9d1350b7ce0c373cc3397ba10b729e84d7ea4a803fe
MD5 98471168f89f4b05f3261c9da0d23e2f
SHA1 ffad9454f247e65630390ae8f79964307513b716
SHA512 24ae9941960aecc128f56f7355e6892b54c4b7caa22bb4aa8673dc8ee29fa7e93e313284b67499545a4abcdef7b9495f8d1b7000b918754a1b446a0b49869be5
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:ZwuoOWysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 083b53229e997cfc27b3d248b797dd5f70fbfbed6c33c5503e8726caed35abe8
MD5 a8cb2948740906907c3b305d3fb32593
SHA1 724ebee8062d877d5e884f1ab9ff16bd900cd311
SHA512 4f6391bb99431f37d5ae35311861856d8b04d6e85c5ff985d03a20ac159460237f47313e50196d0691fc4b45e5ced20aa130b4aedb55dfb3adcebb771f527ea3
SSDEEP 12288:+BZ1IyeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4Zu3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DD5512AE239820FAE163417CC5E5D609E7337C62673003CF166656AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b18a6ca250f01453219638fadfe7f1673f4f127172dcff738b96395b368976cb
MD5 b2a196996a9709475ea6694153a880f3
SHA1 a50b45613d0f8f7f2b18cd4b9665675c73cd966e
SHA512 07c017a4ae88d57e6c4b4a71c5d97e8fe0c09e5c05756ff405745802f301f64bed0a61034e2ff6f73d4df72d8f906d148a2a3f14338eca4e6d1a328895dc8b89
SSDEEP 98304:WQRQyi36YOcPQLvw2gAf+PN3QD527BWG:dQyiKayX+PNAVQBWG
TLSH
T19F667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 00e0a47bd494504f0b7cc5c1812d5aab1d4cfd3deaf5bd8d09aabba4e374b0c6
MD5 f28d4a7e0bb6213164b87a0fd48c11ad
SHA1 62006a45a4a97a64c8f3390d42ce1603ec6dbba0
SHA512 2604d86799588cf33334ca22dd626207cf51705d6ba1cc5db1a617fc9321041355b88edd946e87357d1eade9eb26c622285502ddda342302af3dc3e678c07b2d
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN3QD527BWG:3QyiKayX+PNAVQBWG
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5a7a9f740ab6db18ada96f4df8bc3df2123f6863d2e2d12b17dd94af6ab3dd82
MD5 d053491fcd383d1c3321468978dd295f
SHA1 93b29355cd21120065e95709c8a52451e5b44204
SHA512 d7f31a95e5063ac8533bf2cffc6eca99920366b4bed0451f91e1a51e728fc542c4b0475b9432bb1133bc1514d8b352a9e0423f2ca6ddac3c5021f77a7afc1ee4
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0nsqjnhMgeiCl7Ge:p68Qg55nhheWu7PNU3/SDmg27RnWGj
TLSH
T16BB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ff1f6a25fe5bc3433698a559fe88ceb602ad375071d4e9cf54e7fa019c993252
MD5 8aa5d806550e676edf68bdc09d2c3485
SHA1 ed68139a5e7f096969ea787a7fdd061ba5b5d58c
SHA512 6381a5e3a9ec5d883f16555f11fbbbc4ac0e4d1973ca4eadc7985ab18431fca3f198b9c94f658df0ed1e830c9baa3740ba143c89201ebe807f7b0b111bacf60c
SSDEEP 98304:2y5112gYy5azzVvL69nLKnhZvD527BWG:nLIHmWhVVQBWG
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e624693ac107e0bca5ce0530f275c3811d7f0c167a3697379ea4735e0f7fc3a5
MD5 9a7ab3cf8ce57988ca0bdb8b8e64489e
SHA1 323dd9a81d7c42c7a33c15a311f9e0eda9eb2eb5
SHA512 2e34e69c854686f622e945ab335287fd9d3b9c6dc99b46b3cbc29dbfde98d8f4815099a755a0747679360e5eafeea14400b9ace95a5424a92aa6a6375f9b16f6
SSDEEP 49152:JB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIDmg27RnWGj:fu6JmVxd2dID527BWG
TLSH
T1E5D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f45d09beb5004c880c778a9fac2fba6b9c14094aee1429960c594207d606f457
MD5 49693d40bd478acfd9e1421d46920ef1
SHA1 3dffe077d6663c2ca3b4c94e5b86aeb9d2554d53
SHA512 bfb8020a0c0682fdae380a198c37a06c7ce2ce7544dcef7cbf47df4534aa48a7c7abb4c1062442135c057728234b577e47737368701d2d818099a04d56905631
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xcDmg27RnWGj:HmifPbRND527BWG
TLSH
T18AB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a45d9060893faa8c9a9f23990f43c3706af8f929208c1e83eea0777cc31ced67
MD5 7cbd58608acde6a80e991ffaf3e91c63
SHA1 8cd685a277b7ab528cd9915cc8f7faeadb624b1f
SHA512 b153712f2d0367525caad886ede0a8fc50244e84defbdfd9611f204869a0196c929f285283f09b8dd8828f1c7ccf195fd5f0218143e576848059691755027e64
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqLDmg27RnWGj:u5dKTi61LD527BWG
TLSH
T183C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10c6cd54830c86aad5d468e3a3534612cd074cd78361e6a67770b6916a51922d
MD5 ac5b2c3f88b9f5552dda4df523e204a8
SHA1 110ca99afe75ab2c14c8897b27c5ef3988536dfd
SHA512 b7eb50ce14f580d23de5798f34d7ecbbf7d5c26f94382a2508d05fa2c0a9eae3893be1ffb04e1cc3278483266492ee99919a0d65153f9e5c17d66d6d5f0bd74f
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wYDmg27RnWGj:mX2iyphRD527BWG
TLSH
T18995BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9759a17747ab56b5e6d31531e43d4855b28fb42f7c95a83eadde206de1d34118
MD5 d1fbfe591fe3c3f182b9fcd24942242b
SHA1 188b5857fa792060cae0d49db72077a10a4478a9
SHA512 b389c0ef3a1478025b59764dfc83c70a5a75e3f3f905c7571ecf7374c19cb0b0caf1f95e5a5911ad6f6b841e4d259282eb4ffef66c8db32e89a7b67f54a33667
SSDEEP 12288:zjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BE965C51CAE52648B5C3E5F10EAC073E5BE92004837A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dfe7abfae0acb16b6f8a7c465469ea9c2c7b82a2dd43f2a41d6c02bc1479d914
MD5 a14da78373bdcefe5eb23e861aece2d8
SHA1 8eb53667b981a5b1f25f3e9e6ecac711c1b06d01
SHA512 15abd6066df6a6ce0a520cf12bee1b7ab4636576ee22b7a0650cadd6ff86a1bebaf0a6691cdf8eba166bd5f1fd3df480ed64732b7ccdb2e0b713206621d0bb93
SSDEEP 12288:8KXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AB4523BF965C41CAE52648B5C3E5F10DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 555bf48d11fdaa455b617421bee6f1dbed62cd04a5cfa2b8fc29f4f20fad61c6
MD5 50079771f84bbe3c7cf556f8155b8fc2
SHA1 e1663924ac8beb8498b988ed141bfa9a916de36c
SHA512 74f36c172432bd2491922fcff8ae5cb19dd5915203f933ab43b11319703c1a59f80725559c30635603ba1aa8cc9ae5bb75f91f4709a875c16e9fee3ae67a386a
SSDEEP 12288:8oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE965C41CAE52648B5C3E5F10EAC073E5BE92004837A977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 92eb0c866db1c5b547c1e117408ed1015e6e0967c74085a7aff6d914dedcfb34
MD5 3bc0953ea51a80006e3fa98cb04f4562
SHA1 bd746c6155d7169517217adb15721d938685079b
SHA512 20932375a4ca98de98c6ce0234651d7a851ae98f8a37ac24a0996c0224a7759568f3830cf380549209ee9cb44848db401a3dbf1b92a0e18cc7715ee45ba6102b
SSDEEP 12288:pVJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D545236B675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 24e131b351e3db1867d67407bf583ac8905368c8be81e62df149e63914018311
MD5 491ce922c94246a4a7a3bab5e1957ed1
SHA1 44a9839f701266990c5dc95eb528e7e4532d5dff
SHA512 d37c9aea0ff9fe735237dec85ffe49bff5f45031dcd3b08a3cf6387fac42d9cb4daafe7c7c4f734cb97ffc87bed5da629cfd9978e5dd9308f28fac6799b9aafe
SSDEEP 12288:lhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 2b4eed5d3d578d99be3a12f868182de6fecda4dfdd3afde284c9c7164a722fad
MD5 7c1b75e4212173455b74b06d83e7d250
SHA1 3ea4a149bd0a966a54ddfd7cbf330149776df18c
SHA512 a974973832199d3ea2a5d968b579036a6a308b37da5d0e249df3860d3f60c5587800359fcd3ce8ed1a56e0ace3d542cfd3e31d0ddab822f087e611afbbff861a
SSDEEP 12288:+2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dbce7783c2702dcf8b10266b0da9bc073b6914024be81c0839e866807602bd1d
MD5 3a651930e519efdb68c0b9067d401a3b
SHA1 1306269cee6c61badd66bc490e39b3aa2d2eb5f8
SHA512 7589666d082d65cddd87bb060c23f9c7263729ccda178093e32111e85efb9b1a9259adfe9578cfc04c65cdd932de73c738a9cf39db3ac6537776f4c5c87591c9
SSDEEP 12288:XiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XisqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BE965C41CAE62604B5C3E5F11DAC073E6BE92004937A977CB9FBF14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 53662790597e2b77f9c577ba8af26d481902f09747fced7c81dfa4e9b9a3420d
MD5 6b9a5ca8f5aa124ecbeda02effe34c94
SHA1 4a69d19b10cd76696d49e1cd6beecab43d540d4b
SHA512 31ef244929ea98ba5104bf75671828b23efc55e49e938b9c53920d881de3abaa2bf34a5f3cfa9b4731dd2652c43ceede1630914278c82679b2ce1eba1e2e626d
SSDEEP 24576:pZMSzFVSOqsqjnhMgeiCl7G0nehbGZpbD:pZMSzfKDmg27RnWGj
TLSH
T1E66501A9B35018F8EC63813EC965D90AD5B27C5A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 60972e5e1026021f757ed8c3f638cba271cf0458ceaeaf34179098b4f4f1b86f
MD5 c3483ca7adf6cbdf41ecc59194571330
SHA1 965f0c09378f9e869bdb9052a02a4adb939035ae
SHA512 2b6ee5d5670d4d8be63a3b40dccaa200d1f0c99213020e61d52bcb387367816224129b373961617e2da36d6f52811ece0e16f440dc1f364ff7b2eda2bdc4bc16
SSDEEP 12288:aHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0f7c6de899f7323c17b341825baae89bade9118e9124d19173b7d3067c03f044
MD5 5f84eba7fff71b557c3b233e521cd226
SHA1 ae06212a3b833378064be8fd8b67fd9467b4f935
SHA512 40e4deb73633ac6da9eabc74f130276c4ddeee752d770ee002ce37a0e1ccc786246fe338b233d41ea9ac23574ffa5421f466644f726d4c4c2863441e11302a9c
SSDEEP 12288:zLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CAE62604B5C3E5F10DAC073E5BE92004937A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 52323a35f5dc8b5bc39702c107c39e95be72f1ac412eb5ebc70e13498a149349
MD5 87b855581f6d88ee48ba55c64a35a6db
SHA1 7cb30f9bf58b488f472bfd0191fbe8ef9e896916
SHA512 4505475da4e5735a55e125000e43ff5cca85b2117520fb2259a796da778e2f30ff3125627990c758f7dbec47ba983b62dc8c9c101249ffabb457d4c57d3ba1b6
SSDEEP 12288:9yPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0zyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A255125B73A530F9D1378138C5A29A06F7327C3647204A9F17A506BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5ec4dbc8b5d46ca74ef438e2bf11a8291110c5a62a7736ba3381a8d379baec6b
MD5 332540124ce63012a5b09f792069980a
SHA1 9e4d2f63b5b7bde1eb7978fcb0797fa9edae5912
SHA512 bdf6ef026e79d53ab140a507734aa0b49d87c284c435ece1bf2d1b1bc3c6aa9da473feb77ec5edc1378c53addb0020d9f832e33ffbcc6db861e1944d6a03918b
SSDEEP 12288:0HXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0HsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 46f247bb621e266c9f85c2228b209011645bb013797565046262583d35b25e37
MD5 276328750c833ab5cbdd2dab67a4cd18
SHA1 afc27155648d3305eeac133ceedc9a93cf40520a
SHA512 af266e6fbf6b6ee002e1ef53d04ee1753ab6683d1fbe3b8ea746d3ba1e9164ac595ec8f928b6875e9d13881daade09f52285dba7e5f528b891a42ca9f09b7708
SSDEEP 12288:bHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19D4523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 76e467d8f7e4b55868c7beb82abbfcc2d39cd52442495479c81278fd32a5b020
MD5 5b09c6c1c5ecd53cc041d08057c648d4
SHA1 fc27be641c2fa67fb10dae96961e347fd1b75e19
SHA512 a32bb3ce747daf869062d2bdcea17ecd12802a4bc3f7f784f740dd51a470846a7defb58110bbe75aac6395b4a056a7e201acca1aaa67e4439606ad2255b12831
SSDEEP 12288:OyPz5L8eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TzyesqjnhMgeiCl7G0nehbGZpbD
TLSH
T10655125B73A530F9D1378138C5A29A06F7327C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 652e50bd8218e8d8f8b3da2baf941f238b0f92ca5813a01fa9369f6ae370bfd4
MD5 2f1ff3d9e9fbfba7cf9d6985c5e26f54
SHA1 315d3c2a1fa659fbc4b1b26d9fa15c3b7483479e
SHA512 0acf917ed4126a01543e19bb03e986fc8fa640a7b63f5c9d1224d0074b38f20d85b43bb23f4da2b9b631b67de7a90bba574f215ddbe06b80c350c19685cdc641
SSDEEP 24576:rTHaLl3z0zDYsqjnhMgeiCl7G0nehbGZpbD:rT6Llj5Dmg27RnWGj
TLSH
T16D6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9dd145c40d67918ee83d131abb1b89742dd605651a322095f107b9bacc5a18e3
MD5 4f551de61a0ed1c30def675de2cb2ab5
SHA1 3ce6c25ae14e8af98cd69e4e5415b9eb415551ae
SHA512 2070cacb30d311a124eb060f61957581242ec2f585198a15143a67b1efaf0a323d863cda909421b84762c3bea0724da4e3aa31b4774dbbd70e0a02b492a5830d
SSDEEP 24576:737d9CHKy7GZUsqjnhMgeiCl7G0nehbGZpbD:b7d9CHKyaKDmg27RnWGj
TLSH
T10775CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b2cd60c2bf5940f9fdfa14297f868372273cec225b5dd3840f9ec42f8a2cda38
MD5 2c32cb1fe9a9a553eec76a5fab3d0d4b
SHA1 7643b781066b54d67f6d3e9049a6e41138cb1bea
SHA512 9fb9c8838398727bb948d3b3c4bd2a19579904650191a87cf29977e5d00f22cadf0f45a438ca468806a8ac41fbff54ebeb3ac321961f812fc242f2e47e0fd90f
SSDEEP 12288:8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE965C41CAE52608B5C3E5F14DAC073E6BE92004937A977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8cd40ad5804801f1fda02d769a7bcdae9479dff2dbbfa55183bc048c53b28f6c
MD5 75cbd1da6a2e72540601dd04f29c69a4
SHA1 bf142e96dfcbd52b0b3081f1d8d6a200489e903c
SHA512 ff0c99e238b49dcb66970facf482acc0c39eb253410e4216bf15f954a75d30ef755c3c1035b91eb7831006696d9b1f3caa601df74a02a77474a89f59c94eaa49
SSDEEP 12288:m+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1324523BE965C41DAE52644F5C3E9E10DAC073E5BE92008837B977CBAEBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ed1740e0184121b43f9ad5910af9848a240350a2775bc51249d2ac19b10c6fc9
MD5 3b371acf55fc19c79365acaf9397e054
SHA1 38231c31263a0b8234e013e4fd95ba5143c923ec
SHA512 39b89b0fe7ae2d855ecaa7e79cf60740498ee1ba22fcb5f83b2d3ec893ba7d8906bb2b1d2e4691c2f50618b4a578a80ba93e36ef252fb0a808e557ee49054f72
SSDEEP 12288:89Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:89sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 439b7fe4cdce3bf67108b8760cdfeb093478b4982a65075f6e26712aff9cb584
MD5 32e8fcba19b1d7866b79c9175b00d08e
SHA1 225f8a79855cf8946d80aa0ea47225e00dfbc84b
SHA512 82f7c283b02837d0c98143e3fdbb11ecdc2547d23ce7ba2f9fa4a549bd79cb2b49942faed3a7ac8cb172827c24d18772244efc9583202f9cd24b8bdaea865e03
SSDEEP 12288:RHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a497cff756354e169bb21e9ec5856faa3be30e52ebf3af72e6c70b5267404dd8
MD5 069b444bc0d68865c4f67ef6474fc03e
SHA1 4bca88a9ff16fe45f7ef46070e29a9f3556ee031
SHA512 dfbff29702cf85ca233591878be11c1761e868e386c247942fd371e6e7692448b28c5020ec64cdcbe4a483e0ec10b24e9f2c9e422b9aed9eba1ca981ee35f7de
SSDEEP 12288:qNsf3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16055015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1a73e934e13ea4e6e3e175666ab9d5f8397998bb3d0d18b24b7bf3801fbddb2d
MD5 e8c4dd22e9c2963d8d2e095d7edf31f7
SHA1 0e8c740c124a5cda120387d651e32453492676b0
SHA512 9c937043be0414d8243c356f725097f4991d1774889ae1b6f66ab477751194f0256d62c142ce7cd579de21b5206a66be442903e37224b00f09b98cc6d4485427
SSDEEP 12288:dlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15745237FD34C518BE57659B082E9E02D781B3E669E204483BA4778FDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6364140bad38e7a0e280d8867e6663cf30e1189dc04aad50b204c5e136788abf
MD5 c3465b2a6cfa501c4815c4bfe3231918
SHA1 bd108e13ccecbce8cbcef1b18b8bf73d6354a3fb
SHA512 ce26916f920618091efdd32379592d0e34159a9e3650dad81711811fe30bb1b9a338eb821cddd13e433c1c9df31478b8867dcb7d98a0549190447c2099d799f3
SSDEEP 49152:Ra0h2GEkuAe73q3pp46zwwQbDmg27RnWGj:Ra0hNYG4Jw8D527BWG
TLSH
T1F485AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 bd366de929d4de39914d17e17f0c6f270c6116777ace47e1b9f5750f8618baff
MD5 e5ffd60631299dd516b435179e592d80
SHA1 f8e58c61b4001df09b28adc881bf76537baca3c3
SHA512 1a1b252ca8fb045d27ad49607670b10db4a57ea1f61378f68b30c3081b37ce8e2e6570490ffdfa8ef1ab9cc884f7812a27ab882264250b520f48997393330f4a
SSDEEP 12288:hhbHjfXyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hhbHjPysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D955127E16AC20C9E57291BD8296D10AD632BC261B2053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2960d106b7a082aa49f3d410a39eca548459584d5fc6c217d2e80163438bf792
MD5 ca9fac5ced146fa55040387c2d446f01
SHA1 ff74c9f7756e2920c04ed87ef1c69091b05e8b79
SHA512 0cb47be9ab6d82032230fc9ca203adde356c489cf9410e834c393f1aea6f1ced9cb23eadb3b635329bdf2a38a7cb24f1d48d0599df6709d8f654314a97914d6e
SSDEEP 24576:V3YgnJcRTk4yti+R5dBR/UsqjnhMgeiCl7G0nehbGZpbD:VIgnaTk46pBR/wDmg27RnWGj
TLSH
T18C45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bab9a50d6a74aa25fc82f6762607815bf271656306b0d5d123524146329ccfaf
MD5 a0d1bdc8490b90b907d325d71e8d7066
SHA1 a2ce12275e3bbcb235ce6077e41c0caa748910e1
SHA512 35573c8e394148caac384b4d2fc86f0fa8a37857f378b592990d9fd9b587fe62d7d93f8e88eb1ee263a7c6c979adc9e02da94c9813e4a4034d98fb5087a12f40
SSDEEP 12288:eBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A778BDF7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 52e2456d2d7338639fd4fd8da5e0f72066775ef354db840608c826f9f8b7a7a9
MD5 fe0fc33f46880104559e39be2d1db5c4
SHA1 2d69d7ce520918fe796c22fbbde175cfa5fc9587
SHA512 cff9f71764e32f1883872dc36c87bff1cfccb386034faa718a44df36accdf04adb5f28552b31ac25cb9004f350079296ad51dc1ee93839a3acadb02fb16d60d0
SSDEEP 12288:tOb9A4LWOsvAYFT2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:KpL3UT2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A5750159F79800F9E87B813CC5A2D616E672785D0720E7DF03A94A691F637E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 fffb8a2858a0e8494b629c973eec55157b886ae75a55b1235c16ac866e643fb5
MD5 b1db72341b830fc31aa1d6eef81b302f
SHA1 1263b97c7a57687345ff11da457be4ca1d83cc12
SHA512 57cdfdc346a34c6dd417884cdc94484b4d6bc596216ce1a5007d2e31e5f2034abbe00cbfcda9e50104d2698e1636cc8efc2b7256c9eff8bd3b189b67fc3f470b
SSDEEP 12288:ZpFtpOiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZOisqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C755022E33EC10E9E536A17C8692D20DD6327C66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cb7a6b3b00d225b9ee86c0f81ff78ea547b880eb9cd5199fcaef0bb27d7e9727
MD5 8a5eaf262a18bf0ea56f97f60ad86630
SHA1 57e974d537d502f0d9fedaa5748cc3e840916c12
SHA512 687d9edf639e752586c92c24cf603ddaadb5a85492a3950a8bd517021daa026df411266102c11d26f5ee4bf5672960b079c2a0899e9df897a91754e2e5bd24cd
SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhs1sqjnhMgeiCl7G0nehbGZpbD:q7cBWMpPjN8DbEhIDmg27RnWGj
TLSH
T108659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 26474c6e6a1ea801ec29577d8debec1cd4cb5c3bf7657b7987dda684c5f45c6f
MD5 a1b27fa687a2f418eff91849aa8832dd
SHA1 abf1c932f4b6bec7286a925e2976148f7ddf56c2
SHA512 0a2a6d0008f95e14985686d08eba0518a4a0820b2adf77b4ccebd88204b94c155904d6ee4fa29574c2d2afc4954fc066c8fd2be1de6542a604151bcc256f7025
SSDEEP 24576:VW6BApg2YuyuNDYTabvcdvNYf8km1LsqjnhMgeiCl7G0nehbGZpbD:VF2YuHNETovAvNYf8kmJDmg27RnWGj
TLSH
T116857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0b6a9d472911736c12df2afee15b113d790c23abd0eefc0ec646c01f237e1808
MD5 9f79842b1b8fc3bc073625fd7322341e
SHA1 adce45ba6d453423ec6b7a3ed4b8882e8bdc3f44
SHA512 e9eb5365726761b8d4b180653b4ea321a61ed75dbf56b72605e350aca1974ea8dd893cbe7d4914869a4634f75871d0b8531d022794285d3766cffded8ab73de8
SSDEEP 24576:1AFs06+Omlf3NXEbToesqjnhMgeiCl7G0nehbGZpbD:6Fs060lVXu7Dmg27RnWGj
TLSH
T15165AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 238acca84b751c39c334ddc729c69610ecdb3ce31b0abc42ea14a749222be0db
MD5 52ea38030b85858af587e16b65df25c4
SHA1 a9bd95be9d925e5eddf1e47423efd346e7ed9afb
SHA512 862802eb48417ab4164dbaef3f873700f9a0763497a15fb38f98a5a356531114b2302e314171f90c9750c42e5c3f647c6bc7117611b0fee3889ae03b734a55d5
SSDEEP 24576:gJnJ5D3WXnsqjnhMgeiCl7G0nehbGZpbD:gJnJ5DGX7Dmg27RnWGj
TLSH
T15075E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3a7058f4bd08e9e829c88f85f21f7040099d5745fd1066b8005ce1303501f79b
MD5 3204abc4b252054835aec07c838725ba
SHA1 26433a86f41af402196061cbb27a67dd5b08499e
SHA512 d6da987b5baf31379ea893b2e9771735b5e024c95bd29dfc67b025b3846191b12f710974269a05e00ea019af80a21fb92cced5101f886779b8b0b79f31ade30c
SSDEEP 24576:OEPghm6/7IIXdwcXrif7qQncjlP65i3VuUsqjnhMgeiCl7G0nehbGZpbD:Jg06DIKdwc+eQnSt65aVNDmg27RnWGj
TLSH
T13B955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 a25017dad78e227630609fbb3f6927e3d65610e071923e7e751a5a6e023c7041
MD5 ee01ec17704f6107425021bb4fbffa69
SHA1 4303277edf74d1c4a9bb073f70925a60e933f398
SHA512 0102bc17c0201a91d5bb7ac4068731d76ea609641d81464623a2c213f1499b904e72d51edaeff8d03702bafc396764b5cb4502f53b26ea90f959dbfdc210c56f
SSDEEP 12288:bEP3RnhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gnhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B55126E679C60DAD536907D8291C209D733F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 3bb1efb99323c63d053f958a006c24ea5c2c9130d84897439bf9789f0393d15d
MD5 b4b09888c0391bfd67c1622cdda8f88e
SHA1 07b697001ab3ebe993a57047f2e79c5e357dc963
SHA512 03d19a583da49b8a2bc598f12a33c323dc22a8ecaf1b42d7fd68378d3d52939fd706581d7de28abac4784b2e80af468085b9fa7d9b0ae5185293384a6456995b
SSDEEP 12288:PjkysXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PIyssqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D551219639C60C9EA760578C6B3D1589C32BC319F2046DF6591FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1322a95baa8fbfeee8f0977a37a793e401d524b65352ffa7f0e18f08e785fac5
MD5 a1837b8c2e361015bd1b71f5180672f0
SHA1 898bd1672c3580773831aea44331707d1b45fbce
SHA512 dc32f5c11e360e6c23bab12de221e06dbe459885edaf2a03632c2fd243233ad0b7f4c5ec49723f73e3c16361cd3b71e92ae8b62fb9f4ae00adb1cfcdc9530577
SSDEEP 12288:GySXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B445237E525C60CEE93245B8C3A5E60DA8133D766B2014E739E7F8BDEBB24D44739812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 2771ddf9699d48597f5aa99b7f9149f95a2867f244df297cff6419f953875eb9
MD5 0cf0c84c3db3c4fe1a598755fcfbdf72
SHA1 5799733830ba4b16bf284b73cb37dd1934184cf1
SHA512 64a13da2df31d4b52c39c4566d69fad3fedeb9d60038591100fe26cec1bf8d677d9ede2b3230782c23f1f0a66ae484e647db430db549b237710b2e1405fdf325
SSDEEP 24576:aQ9MxZKdcz9dw39sqjnhMgeiCl7G0nehbGZpbD:aVKZhDmg27RnWGj
TLSH
T118558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f4a9b2f45c6128414f87add212952bb10a14eb6725271590b2ce8b79b05d8b77
MD5 c71b54b9081fde6a25396d9077bbaaec
SHA1 0785d7de795f846650fa4e7442674e4a3f9bd49e
SHA512 69542bf1404e13e56743df12711d746ef7a3050d8f9c9ea8c9e6323a59066daab33dddddd6bea300a2653e7a80a8d534d8476a390ddef2af49bff1369572c702
SSDEEP 12288:pyoKo2JRple9poXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:pyocDAposqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E465E01FB76D40E2E176813C8985C249E673B4305B2257CB6692C73D8F639E8BD38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3bce0995b9c772ea5359c9d33eeccd1b02b9e1b481cccf0005122123318f3e54
MD5 54a1abf58c8898d234e7571ad0093177
SHA1 212188eb43b47e8e594ace24d660019721626566
SHA512 9cbf2830aae0fc223c7cd8453cb4702cc296d853cd81fbf3c1bd5d63141fe3069762699ec25e8c6977cabaebfb6ab9d46991e96957dae5ed0d86c05cef72ca20
SSDEEP 49152:XWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKUDmg27RnWGj:P0zuNI6D527BWG
TLSH
T106A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b0977ecb8f6297fb2ac256e31c21049e573c0d13a9eb37348b0263485fb45037
MD5 c89a3bffe618402f0b13da293698253c
SHA1 9852f12ce859a6a187ae2ea6a4b7810d18240245
SHA512 83c820d6876da6fdac94a2b93688743b0e6baa3f180fecda0ab82c0cf2338f4385bf2a56d18c0f02127418d1a7782a4f4867c81328cdc4f009b08a709569c2ba
SSDEEP 24576:O1QT7EcpfxR+N5AWAz3ooiYtjMqbhsqjnhMgeiCl7G0nehbGZpbD:DTDxR+N5YzTfjM0Dmg27RnWGj
TLSH
T11755B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1120-231-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1120-42-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1120-33-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1200-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1200-170-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1252-296-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1252-295-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1252-303-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1252-407-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1332-418-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1332-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1664-290-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1664-283-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1664-406-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1664-284-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1804-8-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/1804-30-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/1804-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/1804-1-0x0000000000810000-0x0000000000877000-memory.dmp

Download

memory/2224-325-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2224-273-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2316-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2316-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2316-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2316-232-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2408-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2408-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2608-405-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2608-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2776-450-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2776-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2860-264-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/2860-321-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2860-263-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2860-269-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/2864-416-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2864-306-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3136-326-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3136-516-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3156-313-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3156-244-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3372-25-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3372-16-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3372-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3740-240-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3740-245-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4208-517-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4208-414-0x000000000BA30000-0x000000000BA38000-memory.dmp

Download

memory/4208-371-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4208-387-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4208-403-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4208-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4256-432-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-439-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-451-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-452-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-453-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-454-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-455-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-456-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-457-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-458-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-459-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-460-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-461-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-417-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-442-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-419-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-420-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-423-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-422-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-421-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-443-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-433-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-431-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-430-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-429-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-428-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-427-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-426-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-425-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-424-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-434-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-444-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-438-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-437-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-436-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-435-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-440-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-441-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-449-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-448-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-447-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-446-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4256-445-0x00000175970E0000-0x00000175970F0000-memory.dmp

Download

memory/4280-79-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4280-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-59-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4280-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4420-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4420-515-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4444-249-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4444-257-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4444-255-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/4444-317-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4716-80-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4716-77-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4716-71-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4716-233-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5032-408-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5032-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5032-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download