1467c40b5fa068de49d00aba1795e66c3805fc491bc4dc2e633e0d37aceebb90

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Size 2.9MB
Sample261026-tydgdsty9m
SHA256 1467c40b5fa068de49d00aba1795e66c3805fc491bc4dc2e633e0d37aceebb90
MD5 abd1b98d0f8b664161c36946d66e9ce6
SHA1 f09e89d4aaab8d3b9514da10cb0282992c12c95a
SHA512 0fcaaa6f28a4034868d83aae8f56bc7cc2d15673cefdafb95e61893bb7dbf034136e3051194b838d4e61d38d71541ce777cdd67cfd40a6b58b4c7f87baccbc22
SSDEEP 49152:PKp1otlisaNT/M+wPyMRYmJzxj8Z9T/M+w:PK1wKYbJzl8Hw
TLSH
T1D2D52333B8F18063F632A5305AD2AEB2DC2FB5320B7419675740AB2D5E390F47DB1992
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1000	alg.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
4180	fxssvc.exe
4820	elevation_service.exe
4688	elevation_service.exe
4208	maintenanceservice.exe
964	msdtc.exe
4100	OSE.EXE
1164	PerceptionSimulationService.exe
1564	perfhost.exe
5000	locator.exe
4692	SensorDataService.exe
3976	snmptrap.exe
4540	spectrum.exe
4384	ssh-agent.exe
2372	TieringEngineService.exe
700	AgentService.exe
2116	vds.exe
2340	vssvc.exe
3844	wbengine.exe
3144	WmiApSrv.exe
1524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d7d2076e9b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5032-0-0x0000000000400000-0x00000000006E4000-memory.dmp	upx
behavioral1/memory/5032-85-0x0000000000400000-0x00000000006E4000-memory.dmp	upx
behavioral1/files/0x0001000000017049-140.dat	upx
behavioral1/memory/5032-143-0x0000000000400000-0x00000000006E4000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f93166276765dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed2f85276765dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e54ca276765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fc7fe276765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a3247276765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000216d61276765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009620bb286765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000175027286765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3512	DiagnosticsHub.StandardCollector.Service.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
3512	DiagnosticsHub.StandardCollector.Service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5032	2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeAuditPrivilege	4180	fxssvc.exe
Token: SeDebugPrivilege	3512	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4820	elevation_service.exe
Token: SeRestorePrivilege	2372	TieringEngineService.exe
Token: SeManageVolumePrivilege	2372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	700	AgentService.exe
Token: SeBackupPrivilege	2340	vssvc.exe
Token: SeRestorePrivilege	2340	vssvc.exe
Token: SeAuditPrivilege	2340	vssvc.exe
Token: SeBackupPrivilege	3844	wbengine.exe
Token: SeRestorePrivilege	3844	wbengine.exe
Token: SeSecurityPrivilege	3844	wbengine.exe
Token: 33	1524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1524	SearchIndexer.exe
Token: SeDebugPrivilege	4820	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 5068	1524	SearchIndexer.exe	120
PID 1524 wrote to memory of 3724	1524	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_abd1b98d0f8b664161c36946d66e9ce6_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5012

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4208

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3976

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1032

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3144

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2111dd5d1216c332d5d31a9efd990b1b640ca07c575ab63f3aaf5e5d6cd00dec
MD5 d217a03fa63b4ed7863e4746b3e93a41
SHA1 7d26efe7724b97c312d8c79d8b21d793ae48002e
SHA512 ea916d0b2bad30af46266e3d7de25c8252f7f5905e3cc83082035f988496c6c0bc9a7a26ba4f98b81db266c94852372ededba57a5adda8fe2916ed10451b891c
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2T/M+w:V3q6HjBbw
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 48bcf8fef095ab1fcd0265b2222c7247de2545d0f069ee4f29ebd7210aa48f9a
MD5 8d8d0e102a85281cec8334603d6f69ba
SHA1 b4e262e71ee972141c8cec81b64becd8d2c4a542
SHA512 67423c49b3baf78adc7054925a25f16e4e4851d87de9837490f803875c7b4d37603002934de2411de1a519ddc9f66d6e3d416532ae1b660c65a4da601f173f7c
SSDEEP 24576:zXYfDtczAKoHjto1GFxlXutIs1WZX5AR:WtcQT/M+w
TLSH
T1B985F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 23fce218f2112467b67ef43c67bc0fff28836daa124954cb04c5b65dec96ceb6
MD5 e89e1eb9afa6bb12701e478bc2ef07a6
SHA1 4b5ec10890baa0adcf13e671aa73b40f8dd74597
SHA512 b8173c0c80446366152051688a699049f4784dc0268ebed7ee5d03e52ce7ffd23c82d75c3fb84dd7c25496d85668fa9ff1f2afb2565450e9c18935ed5b8dec27
SSDEEP 24576:k0Le5ji0hmxIrMFoHjto1GFxlXutIs1WZX5AR:kPji0AGBT/M+w
TLSH
T12A959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5eb6c64d8796766a4eba6fa3b987471cc1b30ad84876ba4f82cbf1a0c024711b
MD5 746cb1d983853866237bae01b6bbb687
SHA1 78f2838f3eb6d160ae7f13bc5db383a82f7401ce
SHA512 9cbd45e461b212c29dd06f8928fb7333ee4afe09660e4ec5278c04c809052eda8eef6adafee41ccf5a5d8cfcdaaa9a4d1e4388d5b400a8bbfb7c9cfc3c5f0102
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWE6q8wyunoHjto1GFxlXutIs1WZX5AR:R/ezSC6vUzPvxHjytT/M+w
TLSH
T1F9756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089DB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 488ae342c86032ec92558ce10d8c6b5b3f242dc68dca07cc3737a6dd258ac04b
MD5 5f06ca063d548c057639d67eddff8bc0
SHA1 6ac9d4000e350c965fee09ff8b5ff7011ced590d
SHA512 dac83434d1972cddfcb09606bccc8cd11e287f1ad6bc637224bbfb6a6f143a440e2aa39fd8aa572a7e72d0bdbff706cc7c596013371dcd406061f74044cdc41a
SSDEEP 24576:GVbqPb88hv/l+6moHjto1GFxlXutIs1WZX5AR:GVO88hXl+ST/M+w
TLSH
T137559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 b4b0f7a1e51aeb3efec1d32066cc26b2959463387f1151fd4f4e9399d1111b91
MD5 6fa5e274c95b90a4893282e8955a3a24
SHA1 f2a1ae2d4c3bc16509c7becc1876b4206fe19361
SHA512 1426ee9e956a00031fd0b1f06f337a3e4b0350187220576f34f9b3948f21a3836105a859e4c1c90dfa3d9e830706859d15c978b168a728ea90de91dda0134d75
SSDEEP 12288:+H3hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYLN:+HRoHjto1GFxlXutIs1WZX5ARSN
TLSH
T1C86523639DF250D7F77A11B02DD77AA1AC77BB05084824BB8B50FE190E3D060EA726D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d0b640c039bed67e1c137e35360d87ccdb35a319e742cf241bcea03714a0c2e6
MD5 6cb7a2244021a4c3404eaaa6fe81e331
SHA1 eb5f1f78271dcbc65b0204add60a4fd12e263e04
SHA512 0757380a762ac666c1a65a052c0a7ad7c13750653ee6886d284b0f998d161cae5421f5ce58777dc602014f6e5ab7e7fb099bcfe03078bf778c33f6ac05648bca
SSDEEP 12288:JeBNUbTVO86U8hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:JJIUuoHjto1GFxlXutIs1WZX5AR
TLSH
T17C85CF3BEE38FCD2C27A4DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 060872383c7d1eb447f4cc76ab9df4629fa2de3017aaf90c3109193de5bfd3ec
MD5 c89489abbc67615378ea9149f7f3f5aa
SHA1 1a156408431c6a3464b17cb2984af60a5a29b2ab
SHA512 2b7d2e23507e1542b5dc5a7fb4d1e89ffa124da8d8c983e8f655c28a7628367ee4f6f3185e9b7b9e8bd0a055c6fb4d7109c7ca5f734113bbfaf8445053ff916e
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH0:RQvGAdlCEL8c/yRNw5CSw
TLSH
T1A1266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 98f7df0a34ae75c72b093385a0641810a45249887eb71f24627d1b0bb853d3f6
MD5 fa6b2b10666dc5d4ebf356f3dba6069d
SHA1 d335885276ce5bd2018d396d64b8c5f680982339
SHA512 de850354a56baf578445fd685fe5271ccab2bbd9615259cf3e87522b735b801f61d59b1f05d45a6130d43f9c6d6d0b9c14b9a6b12345bd4332c04519b4368022
SSDEEP 24576:f7ewsAjQoHjto1GFxlXutIs1WZX5ARdN:jljxT/M+w
TLSH
T14985E031FEB0E036C37F0DB12B26D716687DBA204B5119C3E3A89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c7fcfb23a9e406497faab4603684091496da2cd3ba85a3d29f0fbb6941cece96
MD5 c97c3fdef56ef018b731cefc2b7667ca
SHA1 7d774f3e3b199768be4f8c6d20fd347a2e551c15
SHA512 62e9afca63752776d69210fbfbe2032920e3f20d694c753a7e328d8b0bd2657b982d6fc73f85009142bc96f557bc3f4b71a2dbab0884ad3fba7b78c99b2ba381
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHO:qUEtQevvqc2W1cpV2EI32
TLSH
T17F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7261f24528ff9d139dcfd502de0221ee206165f7d7f9717724b249958aa94bd2
MD5 1d89f5beb8d4b78110d57c8de1644e90
SHA1 0c940459367216e202169f0e7f6e2b8fe2767ff2
SHA512 77e0722b86bea6cd1f0cb2e1ade5133a3d0ce6d24bee50f3a4e0eb7a67d153964279e9faf61fc56185f94e53ed46a81b1cf83326aa19756e56264dff6d36507b
SSDEEP 49152:XCbRquA/m2yL5zQfFiV+XenmE3/zRT/M+w:AoqtVjnmmw
TLSH
T13ED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dba8c8558485014fd627a67bf96bbb4b0aafaac58b7bb4062d9f09012e4eac2a
MD5 ca3c5fa887a80fdf648716ce139e3fb6
SHA1 93d0a018c48b760c998542b28c2e2fcbdf6652da
SHA512 6c68c7d2a02d36794c16a314351d80f271be760008ad48bb498f7c5d594de31da364423bffc9bd4e0e86a6820c3dc024bed3a7ce6cbaaa441eda44781a403290
SSDEEP 24576:VAhGLJIFoiwtA5l7S537oHjto1GFxlXutIs1WZX5AR:VAMyFoiq5UT/M+w
TLSH
T1AF35AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 a01512f3df8745c71da04d25b496260d188b7f5bb4b1d863aca3c2d2d7bee911
MD5 b86ed0949bd59bb0e7396747a961903c
SHA1 2b72ac773d787c7e83d85efd5a44e0f39a267b2e
SHA512 d969d58ee6fd452fe96486b8a412564573ac88a3f8dbf4d1803ca9b3057e899705645703f911664d2d501b2708994288dc4050592852a33406d4a16f4bb9feaf
SSDEEP 12288:gmw5HEjsChNDBFgl0WDm+C5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:9wuiOWEoHjto1GFxlXutIs1WZX5AR
TLSH
T1C385F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2498e751c1968c9899c8794f4be73e07e049cb07d8793259f8404cb9a418f843
MD5 85c1fffe949a6f401ac788b0c2fd81a9
SHA1 35f221f30e7e160d44b1c2c10be9effb845d0299
SHA512 47dac9033cf1a679d346a1086d60abedcd200b5da838843bc650b079613a9cbca68ff649996a64dd085097f4d0ee6bf2d9f50c70e426f17f752cc559e8111be3
SSDEEP 12288:sTZ1IyahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:IZutoHjto1GFxlXutIs1WZX5AR
TLSH
T1DD75125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 70238327dade252e99784410db168a7afae2edb6fce3934df318cd34e4a6c981
MD5 bae802333b468441ed163652407d9d01
SHA1 864a211ea5c77497fa4507dc03b206587dfbff02
SHA512 12b63d8938e414641d22e44141c9bf01aebc52e59295c12080b63e18a08f7b88d252ee3dfcb5454a901672fb06e1165988a59b2de6c87522a0ba25bf921a825d
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:qQRQyi36YOcPQLvw2gAf+PN3Xw
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 93a7396fd3498416a1c02967d59ea2cbdbee6618f42ba2591589fcc9f20a08a4
MD5 cf1ca793aba213431ec1bce75941e945
SHA1 8ec72cb6f3f0f1594c41a4a70ca2fbb040913833
SHA512 becf683ca525c4e0f6da3e4f0f32b4981bd0469d37f636b2a807f5ea3b72829467e76a7719df11be68cd3effeb96dbdee92ee3487c6c60477dfb5c7684d30b67
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:cQRQyi36YOcPQLvw2gAf+PN3Xw
TLSH
T197667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ffae93b1fc00ea5f05c61b2c1278e0c93d755353640c6685dab4aaac6a2ea824
MD5 cc63f253e771093cb58a27a056d3006b
SHA1 77988fdcaf5a74b7532756b7e91e40319c2c8fc6
SHA512 b17c65c270e071ff9a54776101fad012f50fa860a5d02808764ae82beabebc1651bd763c8a1eb51453972c952f460058165e90c475207014efe7e876363fcf4f
SSDEEP 24576:kwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0doHjto1GFxlXutx:K68Qg55nhheWu7PNU3/BT/M+w
TLSH
T17AB54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53bdedeacc5ddad1105eee45c419c786e25246ed520f4c840ae3c7565d24ef8c
MD5 0d47fd35f9dbc5539673410bf786d31a
SHA1 25204961c1dd9a5a46b3cda3a76bea2eb76ca85b
SHA512 a1cde36c1938af3beb51cb459b293dbdb46f7f3704fd88775f78d2cabe34659831f24158dccf2ee837a72c7a52426fbcb5125d1eabc8776df2ff941db7c04459
SSDEEP 49152:f3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk992:Sy5112gYy5azzVvL69nLKnhZ8w
TLSH
T158167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0842041acad482a5f850ca2846537923452c706ee2051c05da915e4709929506
MD5 21087cd80a1d756505309015e4f7c9da
SHA1 067ee7d5b2552ac17dff5fa88b5c8dcb3b2bd5ca
SHA512 0ba18e706eaae7a14471b2ba8c38c004d91b2175f9b64d6ab09a059f23721882ef6d684c834d2fda8717bb552395bacdbf3564681326b7236f14896a709b65d0
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTT/M+w:vu6JmVxd2dPw
TLSH
T103D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 27b7b6b3d8ca4732bb7397353292802e4ef70ab3abf1762e88debc43ab2711bd
MD5 43b215972c2beb9ee88f87083d9b7b4a
SHA1 4c12a711397f6cd974666e5bb2a2954245360058
SHA512 3d349587b52094df27bdee0d642ecead34e0096b5b45386b4ea04868d267f8f24b7bd5ad0a5dab0eb47d2f19199e94263f5b95ec9dc6eac08270b4b7baebda53
SSDEEP 24576:bhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3eoHjto1GFxlXutx:x1hpsNoJpF1A6UU44CwH7R4xvT/M+w
TLSH
T1CAB5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 26fad8f913d09fe0ce5d97dd5f3fbb347b25d99067de624011252610b0dad05a
MD5 ac38de3c7b0e40d77ebe6bc529a13519
SHA1 7b8b39806cb6ea802e11ae1088e9c93c508e5351
SHA512 d43a37aca84900928a8d350b3f59dcf96739a48be3bd0aa31f7541df80c7b6482ba99ead42432e77d26bb6f7687693cfb9cb1c9a9b360d70bc27e05b0ad54a41
SSDEEP 24576:n4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqtoHjto1z:RSuZQIY0Be2KRRVtOnks6NMHq+T/M+w
TLSH
T150C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1a4ad54e1d0de35fd3b42788903b495e40b29072d0bf6b917f4fcbef82842ec3
MD5 db1360fcd432b278ecb829632f3fd943
SHA1 b74d6b014ed1b5bee38d82e6b55c008aa654ac3b
SHA512 0fad2381493d6103a5b532305d429a2949174b11e68538ea90edb47e0caad62004e114799e208a004aab32bcdbc5ab6751e2736f7b441a413d6d77d8f25e8775
SSDEEP 24576:ohiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLeoHjto1GFxlXutIs1Wg:ohtSn8EApI0figngiDn0AP5wDT/M+w
TLSH
T16895BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 79184a056b200ff81a7e07348b5c48b92c28418ef37bea635d89c6fb25534289
MD5 dea7ef714389640fbb9555c0cb85c156
SHA1 74093973a7479fe697f8e3dc36381e564ebd710b
SHA512 5531cd9d11a5eeed6aeddf2b5984a6477a877ab4471451d004f85db670fbcdad48a1ac4040e1187c182d233912dddeb00dedb6c744cdf6c0736a610d4c9e6bfb
SSDEEP 12288:pfhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:p5oHjto1GFxlXutIs1WZX5AR
TLSH
T1216523639CF240C7F62551B029C77AA5ECBBB347594920BB8B50EE190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 b2b39289de2e4e3a720e05ac0ea8853e0127362972d8c8e8421e5b479267ec5c
MD5 b01d85f28a5480867c5bdf686362a8b8
SHA1 7a7b8b85870d8a56e244aa3e2bdf2c5722f744fc
SHA512 430295296fea3eb5d8a4046f86049c6e160801a26f078a254171dbf891dfd232bd7d5adcf72b50ad07e27a5c9d32e0ba514dc859f447ac8a335f144c6bc4339f
SSDEEP 12288:QGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:QsoHjto1GFxlXutIs1WZX5AR
TLSH
T12C652363ACF240C7F62551B029C77AA5ECBBB317194920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9bdd646cbe715cdef69691e96971333930cc0042824819fb90fe073c312552f1
MD5 230254f1441de682b01b392736d1b02b
SHA1 8b7e3be029a8bbfdc115d9565e7c2253312e1435
SHA512 97f2403bf503aacc68d0949fe9a897971bc0abdbccf222499f1cc2b6a399b26f94513a9f77efba6b05319b1bf3d77a049cce12960155c3c3170c1cb133cedc59
SSDEEP 12288:tkhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tWoHjto1GFxlXutIs1WZX5AR
TLSH
T197652363ACF340C7F62551B029C76BA5ECBBB347594920BB8B50ED190E3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f3d7a078b1de446580332dfc3b8a3086bceade522d78978e8f3fc1c1cad0dc41
MD5 25b2754b6056cf79b476daeaf3fcf22b
SHA1 7072c49a067b214bac93ee8be15e7f58d56f1bcf
SHA512 507b6c9d94ca44f2e84a763a34e5374a6e419f85d03536233d0e8054bd45bd3b0619b939a7c54efc046801b750821eb0c743e9c361909cd58db7f79a279c65aa
SSDEEP 12288:wVlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:uoHjto1GFxlXutIs1WZX5AR
TLSH
T1D96523236DF200C7E53692B49DD36661ECB7B6565B2521FF8B009D190F391A0BE35BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 91064518562147f969235f934a744b1ef9657633167f280d1d55f780602845ea
MD5 63cc8094f358cd31ef4486762232c2d4
SHA1 55ed3c6640efd0e9289e01d447caae58007d9373
SHA512 e9304a69f58d7049a328d54ce225c328e5bc9a4c96c65ce4cfde66b49d48d6977104309b43d7d33889d2fd06033b731a434544e7f5f9dda3340d1a067cc5c8c5
SSDEEP 12288:R9hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:RzoHjto1GFxlXutIs1WZX5AR
TLSH
T15E652363ACF340C7F62551B029C76AA5ECBBB357194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 3a0c51b18fc4cf030c60f6f6afe903412d6550be10e92fc79f6a45f864c3f7ce
MD5 0583adb2a052f2a9208687af0ec59def
SHA1 65e121ae4a886262ab6178214974d925ab5fb353
SHA512 95afcb2fb8779628b134761c74e24026a4131e354e1e11d756efb9c9becfe8636b26056905afff8460cf6de335a1c0b89760cdb4bd4d99eb1d8e8420e8f61e50
SSDEEP 12288:pyhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:p4oHjto1GFxlXutIs1WZX5AR
TLSH
T1EB652363ACF240C7F62551B029C77AA5ECBBB317194920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 6a8fbfa1fb925902a1d13ab8ec6e7be51d9f8a2c8942b841bb028d6355819712
MD5 fed4d9dfa8d71b1954f9a7c6416735b8
SHA1 e870d1eea91af369127540dd1930209991fac0b7
SHA512 2849cdce520e054bc98e23535ca8ba80df9f6201bbeb1db2496559798525899988abeb87fbcf8b6670cfceec947654cad63a4fb53a85ccfde5143e2f0477ab57
SSDEEP 12288:5ehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:5EoHjto1GFxlXutIs1WZX5AR
TLSH
T1696523639CF240C7F62551B02AC77AA5ECBBB317594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 dc90b1e9fab478bbdb9976f155c046ce7faf2bac2a8247a0b78ab8b8f2ff20a0
MD5 900d10f1ce17012d8d1eff225567ab61
SHA1 570b8b1bcda377cd80356e830a966605f92661b2
SHA512 08169ccd2b07255ec1914b933a8170637418876e0a99a4efe81ba809ae73d8c47a14def1336cf0e3bd1974df2811338756f9249fd282cc0e90c691aaeba63051
SSDEEP 24576:GZM0zFVSOMoHjto1GFxlXutIs1WZX5AR:GZM0zfpT/M+w
TLSH
T1D58502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3fb21b1917ca8b0be5506940103e96684b8e45b964f4e543f401644679ae9671
MD5 60dc2702fe9f9515c351fc01d48a2df1
SHA1 43b517ad0601a02b638266ee1f3bc5ce43dad8f7
SHA512 14e074f1dd1d2e0c9debb860ae79d2d5f510936e9bae1e9cd4453004a31a190bb2be5905464aa972620b2649d976ab98681e9eb710f625336b90943abc323030
SSDEEP 12288:ZzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:Z9oHjto1GFxlXutIs1WZX5AR
TLSH
T1CA652363ACF240C7F62551B029C76BA5ECBBB347194920BB8B54ED190F3D0647E766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 2f7636f8cfeb9b8ea733c52b07982af89d4aec5b4ab9b9d19b477e54b4029086
MD5 0d496f9912cbeff1c6bb69263d85c996
SHA1 c8a21f280c3b9d36fb3df5985cd90c2fe1f9f5bb
SHA512 ed543821011cc3404176708f28a67df37083b9ce79687285f823db9e612195a80145774d569e6914cbe3473cc491d6260d251a91515c1fb0e42f26c275c55cdf
SSDEEP 12288:CnhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ChoHjto1GFxlXutIs1WZX5AR
TLSH
T1D2652363ACF240C7F62551B02AC77AA5ECBBB307594920BB8B50ED190F3D0647E766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 f1d83c2865a015832398a72a9d47db6e79cb198da0443d162dd095aa8fc40457
MD5 a50cc9821006e8a09ca6a13a6474326d
SHA1 cd9cb2c8be2f8d16e5e26cd98c82576e2f2a7220
SHA512 22f94ee9c099efcbd48937df286f274da2576c4f3fca61abf4f9e6ae687ab6edfc30cd3b94885d3fedf5cf89eae053c9a0e2bb44164c6dc5a34b1d8c1b012a30
SSDEEP 12288:EyPz5L8ahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:dzygoHjto1GFxlXutIs1WZX5AR
TLSH
T16D75021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 60c7f2ad221043862f4d6fc1c65be21e5e29413df2ff27c37ff1bd98ea01ad46
MD5 e65a0188727cc852cd37a59e71da6809
SHA1 df6e6cf9666e695f2747de4c5360a5f32321e3a4
SHA512 cb8f5c45bc1525b2db88677d0e65d3e0842054e6bf45709ff3bfb9c9e0e82c5bd28fbe8e660f5975f598355a8c131a2f6025358d1b9b5bfd99207af487f58507
SSDEEP 12288:ezhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:e9oHjto1GFxlXutIs1WZX5AR
TLSH
T1D9652363ACF240C7F62551B029C76BA5ECBBB357194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 a84f9a1a05410378f2463196f30fde2a583daba2bfc6c11d74448484b2abaa6d
MD5 37303d15e3dd4d8e7b348c0ec0c2efe5
SHA1 02ead226f9110298bea751e571714cf2e963d435
SHA512 b913469d3c044fd8832ff85802b47ce55dc5bb570e54a1d14e45748d4494afff36d9b7222ee632afb2d9f06b166e6b30e0a8141563e57c10fb05a0a4392588c0
SSDEEP 12288:HzhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:H9oHjto1GFxlXutIs1WZX5AR
TLSH
T18D652363ACF240C7F62551B029C76BA5ECBBB357194920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 687ca7cd7a4c5536c7b8dbdc1212c14f61f3de0617bdd327232fe37028bdb405
MD5 5f22b277a3affff7a5a03ebe135085e0
SHA1 1beb07b9d33216516447537704631c9fd77339ea
SHA512 b49b922990eecceece8b561ca0e8570be69a51c534058cc623465cdb7bd7c3132bc00ce7cdec5af57f4dcd7b3c2aa36bf63eb773455bcb3198eaf8f70e4bf00c
SSDEEP 12288:eyPz5L8ahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:DzygoHjto1GFxlXutIs1WZX5AR
TLSH
T11175021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 ff7c164be8e94081101ede731de4b59436665c419a86709313cfc40c36a664ce
MD5 5b2e974ceb0f0f5efa7f5ea735a7ee35
SHA1 b11bc3f238623081e3ab9b4e15c75fa761abf046
SHA512 ef437d7df55094c5556b20b1dd0c6c6cacfee078381c60c68138e5dddb329e2aa243d69ec5084184f07337d9d805ed0685b05f162489382e33c20e6416b6ac25
SSDEEP 24576:BTNaLl3z0zDGoHjto1GFxlXutIs1WZX5AR:BTALljoT/M+w
TLSH
T1288502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 652f83248fb4c96479c27295e1e9a88a7379cd346946847b4030c85740b1a8f2
MD5 77236a3dab95984543ac965df0329745
SHA1 6193ce5ab2208dc08af8fe5c0460414f0b8d35a8
SHA512 06c34788692a093ca7d4f75624533cd62a2151c46c40e7384d687c804d1919befe88f1d1f83e25ea7fbf2fa98f1c00808a4cfdfd2077e570fb283e71e699abcc
SSDEEP 24576:T3pd9CHKy7GZyoHjto1GFxlXutIs1WZX5AR:zpd9CHKyapT/M+w
TLSH
T13F95DF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 eddb39e2abd91624a5994652acb25ed905b7e935b49cc606afa2ce22e0933d92
MD5 71aad6628cda322d8c7c0789fe13c26a
SHA1 dc84302bb5126bfb83e0a7c3eafb8b5528f03a85
SHA512 5e721cad94653996efded7d5e0c431fa1c8afce86eaa56468b1aa35196fca8cf84390ac032d94f762b74014ff40bfd2a4e3d7ab88325c0bf5d25eb8dd0c14490
SSDEEP 12288:lEhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:l2oHjto1GFxlXutIs1WZX5AR
TLSH
T14D652363ACF240C7F62551B029C77AA1ECBBB357594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 6145212c2d36552ecd1abb26dfc15869497c8698e4ab099a0da857b77fc3601f
MD5 dd5b478a6b9512d87bbed6a4168c7346
SHA1 d6f413597e934ce18fd72515ae05e2f0f6a76aa5
SHA512 c53f785ea759e3585838133af27bdd96f401b32d5566eb6ff4b26982f5f0613ccc1bc97933cfb22f0e15bcc823ead871c2dc287497500b44397f11e4ce8ce927
SSDEEP 12288:t6hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:tAoHjto1GFxlXutIs1WZX5AR
TLSH
T1466523639CF240D7F62951B029C76BA1ECBBB307594920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 1ad0ecd5c7fafdcd8708eeac23657d04537515bf953d5497b53a9377651bf41b
MD5 9218a21e633194f2cb5e1ae78ef9e353
SHA1 875a115a84dd04ab515f6bc280de148f6daa95eb
SHA512 b25dcf2073ebbca39aac4c06aec020cd87c184cc713a7a0cdc67b172d8ba809567ea9a94df6a6147f1e29058c092bc5945693674973d7eaa9b7bca28c33f3caf
SSDEEP 12288:xzsfDhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:YtoHjto1GFxlXutIs1WZX5AR
TLSH
T17475F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 fd81eff9a312837125a7504e22028b99a97196200e2f807d467b56b6491243b9
MD5 74ec038424557e1ff5305d168c1931c3
SHA1 acd9ea35e6f44e3671f3f7947b7e6fc33573e418
SHA512 3de11c595158ffd83a19db4dddfb3aa81872c94d57899c52d9ef9cf078f5da1bc6db01ddca20da864130550e3d2c08b49bf87946cc0427280c213eeb3f1f2efa
SSDEEP 12288:lLhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERYsN:l1oHjto1GFxlXutIs1WZX5ARdN
TLSH
T1EE65236399F254C7F57A61B02997AA71BC7FB3160E4410FB9B40EE190E3C060BE766D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a8ef569bc296f43d3da43060b50af87473880b758677fc8108adb818dd10b01b
MD5 0dab51ce466aeee586a8a7f4a3c65bb6
SHA1 dd5114be611ef905cab46dc64bb515bd764dc5a3
SHA512 c14b7a2ab6dfd6e13b1f2b1901e6f3b14a7441da99db46998638ecd0a97c6f54c560fb306fab42b584de50693076b4231cac81d1dbed3b7e89426022f82ef000
SSDEEP 24576:goiQ0h2Hm7EkuAK3xV3tk3tLjN2VMbxR86mHx/YY/izSI2sBu9EzwwXg/bSoHjtq:ga0h2GEkuAe73q3pp46zwwQHT/M+w
TLSH
T1AC85AE1E67EC82B5D0BAD278C9A6854BE6B2B4260B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 a33d498eacaa314314fe0db76bdee12db4a5dcd1bf20b05bce39c29da12a338c
MD5 7e50fd39edf681c4cb24fde4f3daba2a
SHA1 895826db5e96ef52900c514f83db2c888fd8929e
SHA512 ff1431fd99afff0e67fefa742d227e5b4f400e9c9b71d5177d44d48fd436bc2d956e6c3c819eab41d3bab609ac55b5d58ffc8f312417486095bd793b439be62a
SSDEEP 24576:T1QT7EcpfxR+N5AWAz3ooiYtjMqbfoHjto1GFxlXutIs1WZX5AR:OTDxR+N5YzTfjM/T/M+w
TLSH
T17755B02EA7F915E9D1BE85789A23C512FA727821033193DB42A0C13E1F7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 b2010a914f65c0ec2a482a11653e32ad4416edbaf6f09deb73f92b609a80b533
MD5 a8ccbbad923252d24b6a54a86b3bc6a4
SHA1 9e94f60027eb4d94afdc6c5e3b0ec03f47f8f2e7
SHA512 e941865340ca46bb2b67ee2b9aae23b1dc5ac70ac61deb4928daf3b240e772f733de6cb691e1ef8deea3342c59e1bd6ac33854d5959dd07c0529dc34ca87cbf4
SSDEEP 12288:qhbHjfX2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qhbHjP8oHjto1GFxlXutIs1WZX5AR
TLSH
T1FA75017E1AF920CAF131A1BC99839606DA32B926171163EF1781C23D0F3B9E46D35B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 865210762fc60686c628600ace9cdfb71ae788398a440c3317c29d75bf8f58de
MD5 42ca6a4a701ba5f22256d49fc9df498e
SHA1 99faf6c8d3147afd1c14a6bd27e427cd6ab4474b
SHA512 97451ad7cdd61ec7c2a1dc71d8a276c943a9f246b2e55c9d7e5526a5382d95bec15b4d04a6f6c4d402f8bf0a482a205c392af6dd4998335687699ca4685dd8b0
SSDEEP 24576:B3YgnJcRTk4yti+R5dBR/EoHjto1GFxlXutIs1WZX5AR:BIgnaTk46pBR/dT/M+w
TLSH
T11445BF2EF2B910B9D8AAD136450247B5FB71782D1F209ACB0170C538AF1AEE85F35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 a0b1ee6466b32ea67e57371d4d7b5f005836411ec571de97af25a272217c2a55
MD5 e77535d1a3cf991e828552de5642ced8
SHA1 7c7f878956d8db610204696f19d2844ae26730f0
SHA512 0eb70dcfe18df628e362c5532b57eab7e3785cdfb5c967bbe46df4577f5b243e1a1c8d8d15030ef861079d99f685542f4bfd6491b1a65ebea8c1d0d1a280db05
SSDEEP 12288:+ihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:+IoHjto1GFxlXutIs1WZX5AR
TLSH
T1DB65236298F250C7E63562B02DC76A75EC77B3061B4921FB8A50EE190F3D0E4BE716D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5afb864841872f1b191ae331a5899fac28f61d7f73a988f12563d662a4b35bff
MD5 b4dc93227a06d2cc12e9a5c4f6651332
SHA1 ac729b30ed2c0b800ea0538c0cf13e0d30d6a564
SHA512 2ffc9eb2e9f64be821c32f9bc3bfca3956ec2033f1ec9ef28a9c78a39d8e5bb3700d8e617efe448d09d25a11b954c171bf72fdf0498d3308961b6c7721a929c3
SSDEEP 12288:GObbA4LWOsvAYFT5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+J:vPL3UTfoHjto1GFxlXutIs1WZX5AR
TLSH
T1EC950155E6E100F9E97B913CC9A39A12E672B45D0764E7EF03A88F251F232E14E3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 65516801e2987d88c2fdbdad1b2fef1c0100e649e1b256a9c6cca34a8af05148
MD5 5d9da8e589b13fe25893c872bb464ee3
SHA1 b4a0d1311d3335ad60560f4fb84d3526c4e08a57
SHA512 ecac1f2d3933c770df4c7ba2bf06287a6b1ab945184829a5a5395f0d26acdd0e8514ed7b1935e7146fba6b116dd4d6bd11918cfaee756e5ae684d4f440ad88f3
SSDEEP 12288:ipFtfOMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:yOeoHjto1GFxlXutIs1WZX5AR
TLSH
T11B75022A36E910E5E136A17C99835359E772B466071213EF07D0C53E0F77AF8AC3AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9b0569c4bc2d4e426d6072ef7604d13a67396d28984188c06ea261c0366e09a4
MD5 62523b7f173e50320b2481936f298822
SHA1 c4949d37e134b81e7b2bb864905c6712f7ad47fb
SHA512 fda8a8717ccb10eb5969f2bd0a456e144971e2428aba0fa12772dae093cade51e373615022ced587c16e33e6d0b6b21fd3fc73a2591cf189f128e6fb6438dc3f
SSDEEP 24576:f7NM9YqZqmWMUkPjZM48Mv6bEhs8oHjto1GFxlXutIs1WZX5AR:f7cBWMpPjN8DbEhuT/M+w
TLSH
T19B65AE2E6BEC81D5D476D13DC9E28205F6B2B4611B318ADF1162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 960bf6cc050bc6097b6fb7d673fe3e00fa30ff00e591a91dcc8c2028fb497a00
MD5 c9177f014d2ebfdb1db61c4e09388210
SHA1 a3781dea0d734eff0f68a2c5042c9c54e8d2ec9d
SHA512 7c5b7a420a482957c7e2a3b6c875b3bec1e05d8ca865e094c077ff22e245a645d0f91f26f690fcbb46c2791461727a6aeabf09f4fafcc3ed71a82f1ebad540b5
SSDEEP 24576:rW6BApg2YuyuNDYTabvcdvNYf8km16oHjto1GFxlXutIs1WZX5AR:rF2YuHNETovAvNYf8km1T/M+w
TLSH
T1CB858E2A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 df364cc1903f28331609e87167996e0f2faf9a6a1d7d4288fc3bf80010f82a4d
MD5 10a9e0aaede08462caf26c7ad5683a62
SHA1 a16b3528d4d4636a11ff98ae8f81f91b6f3f1374
SHA512 6b0bb05efe0c77adc5f1741aa0360c6c244c20c4f91927bcdc2594f095431cd8a204466dd76f5285986eba219f1b45f2b7d416a3a55f6b96cbd255216214cfea
SSDEEP 24576:RAFs06+Omlf3NXEbTo3oHjto1GFxlXutIs1WZX5AR:mFs060lVXunT/M+w
TLSH
T11F65AE2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 f2abd68bcb02c8ff8bfb513da090f01a216488c488c305d9d2ed8dd2f771bb70
MD5 4fdba81efaf42b0b66ba4e466cc386d7
SHA1 0fe17e4d09ca9463044144a98eca893b46522d53
SHA512 787a7fde4da3fe844fab0c329581ec46641f713dc02c47d37a22b210e84b0479f292a3daa4c99ff68f1174cc936a02f47cc52adfe0e2583a26e6fade3229b673
SSDEEP 24576:RJnJ5D3WhmoHjto1GFxlXutIs1WZX5AR:RJnJ5DGhnT/M+w
TLSH
T12A85E03DD2A410E8D4B7C2B4819A2B55FE72343D2F2269C718B4D5353F22EE0AA79F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a46f2b0e222ba48889ec2267a151fabb01a38f2854969bc4df79045c3f349d3b
MD5 6c60ec51141b67195c217083649533e3
SHA1 b871c606d9f51faa7469b6518e83097a70f2c41c
SHA512 f3c2ad1db840b6a1996f87b101b5083c219399e2bad2427a57bc990f89da1b1ba085694e702ae57a449f534b17809fe6ef771508e3f7b3ef050ae152a7815000
SSDEEP 24576:NEPghm6/7IIXdwcXrif7qQncjlP65i3VuFoHjto1GFxlXutIs1WZX5AR:6g06DIKdwc+eQnSt65aVhT/M+w
TLSH
T191956C16B7EA5294E8B3CAB0C962A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 b47173e416b2d89c6193111aaca4824593b403f236418e45abb680e943690739
MD5 37872e0418aed5d1374b52ade6354a79
SHA1 71ec4ac8703b36cfd7671c238d182a0da21c65df
SHA512 b82644cc5739996d4e33c454d5c8c4c7af4d2bc4f1e6941e8448f5be5172f332d42282218df36bb65ac338391a45672ccfc3448329d6318dfa6274cd07c39749
SSDEEP 12288:bEP3RF5hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gFfoHjto1GFxlXutIs1WZX5AR
TLSH
T1A075126E2AE960DAE136A07C59938645D7B3F0211B5223FF46D0C63D4F3B5E42E39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 c378c1c7c689bf4fea8daa5e38e4a72d2a7d8c61edbbc5e28c69084c95354295
MD5 c5bd1c9ec9f2c7ec340336a2a5667bf5
SHA1 72d7045f4dab4b26b3ab0e1cfaee158992349431
SHA512 0b60bd9a4c3ce18ad83ff3f16401840270d4cf2906980cd4080d0428699c8309dbe32aa6a2667e42f8ae9afca4dab23ffb3c05e95e2ab10ee2057b65d46acb6c
SSDEEP 12288:/jkyGhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:/IysoHjto1GFxlXutIs1WZX5AR
TLSH
T15075120567E050C6E67A02789EA392A0DD76FD211F1112EF5680FE3E5F3A6E0BD31B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 b5b2a1064d178d8a19755fa194d260c2b4e152d224601c6a5ccd93e60cd9ed54
MD5 55a1461919a69e2e19138fff4ad92b02
SHA1 3f3c83b853b9888f56e39a7885d90c3464b026c2
SHA512 a4bda5606fcb3a4565a5703e29cef9b115a87c9f024bfd5d93760807941968b190f8e6e2bfc4de684532520c4a001e701a8e989e974f0ebf1cc7883fc3c62673
SSDEEP 12288:vQFhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:o7oHjto1GFxlXutIs1WZX5AR
TLSH
T1FC65236658F260D7F62651B419976B61EC77B3261B0520FF4AD0EE394F3D0E0BA72AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7a903c0bbf5a8e45f78904fdf22367cfdfe3cb358a311dbd7429ceb646d52760
MD5 45d957575e3ba84237ac4f8a378d9abf
SHA1 b84bcb8f1819da7f253fdcebc662b79ed8f528a7
SHA512 026f47748396d9330eb65a8593e42c07e0fc6e2a7081ea78c87dfac12f3504d357c8a617dd156dd4b28b1e9ba84f88cb8d39532aeecf808063eccafb28747b39
SSDEEP 24576:PQ9MxZKdcz9dw30oHjto1GFxlXutIs1WZX5AR:PVKZtT/M+w
TLSH
T1C9558C2DABF9058AE177D27594A250C3A673B4311B31D6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 441ea1be0b4844896cdacf5cbdb1e1502d7f29c5a3dcf92ef3e51b39937c6162
MD5 7bc0baaffca832192a5f82ef3a1232a3
SHA1 c04be0ddf97ccb736c1ec49a7286bf95e4c8fa97
SHA512 c785a936d65d2a8b419c4665e8746b0109b7485b9ffee9eb42f353d775d7de90d17ea045481f69c6e83488014a877625f8be04427e1d30a59d5be9105e936fc0
SSDEEP 12288:CyoKo2bRple9pvhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:Cyoc9AppoHjto1GFxlXutIs1WZX5AR
TLSH
T10185E01FBBAA40E2E176813C89868745EBB3B0301B6213DB5691C73D4F279E8BD34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3fb2e518e63098add2eb0ba3ff5e51c2248d5fbd1eda5708d5c231d591162696
MD5 0128fe0b1f7df36c3c0e7b29054f3178
SHA1 470e9f43c2a579899334bf705404ca8bb5757e68
SHA512 77330f2542db81a5757ba181ce1126a8a38cf4c6ea1a3db56b88b4e63a50019d3bb850ca4070d7171a62171f692f17da4caba5c074edb2c4a77f3a8b109779e3
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKiT/M+w:V0zuNIqw
TLSH
T1DCA57B3DA2F800A9D8AAC375C54613A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 f3294fcd923e646497b31e679af98a7bd1215690b78eda2e1cc376f54af91560
MD5 1f942184b4946ac6b01ce1f1b6db7f0d
SHA1 0e7685f0c706fdca4430626fd6c054de72d736bf
SHA512 c7929cc16c11e95fd04121a45f32cbf534ecfa5080605da569dfa52d730668623de7f9a2e5e8885cab2c6a7872a8c43997c449a942a1ce0d1f88e0e5d40c7a2b
SSDEEP 49152:3TDxR+N5YzTljM/T/M+w3yMRYmJzxj8Z:nu5XwiYbJzl8
TLSH
T150A5E12EA7F915E9D1BE85789B23C512FA727821073193CB42A0C13E1E3B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 fde1923ee00cda0498e77bc92312c4d854a7f570f6e153b41366da4d1c5bc74f
MD5 58100c3b227de914977c03bac31f4f03
SHA1 fc5fecc892c7fe165322445ef742ac1eb2a60c36
SHA512 05c2364000c17db3e430031eb2899241b07d5d87f06dfd452b496fda59ae6050d690e7ef5eee7394025a792743685c126be887b42a77699d2530cd12c08ecacc
SSDEEP 12288:2404hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:6KoHjto1GFxlXutIs1WZX5AR
TLSH
T12875221A27F430D6F43292749AA71261D972F532171421FF2AD0DE3E0F3A5E4AA35B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/700-344-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/700-342-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/964-86-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/1000-20-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1000-133-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/1164-101-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1164-112-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1164-107-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/1164-297-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/1524-440-0x000000000B9B0000-0x000000000B9B8000-memory.dmp

Download

memory/1524-551-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1524-364-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1524-387-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1524-371-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1524-403-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1564-125-0x0000000000650000-0x00000000006B7000-memory.dmp

Download

memory/1564-130-0x0000000000650000-0x00000000006B7000-memory.dmp

Download

memory/1564-134-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1564-298-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2116-541-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2116-346-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2340-349-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2340-542-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2372-339-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/2372-443-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/3144-549-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3144-356-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3512-33-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3512-32-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/3512-24-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3724-467-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-463-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-444-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-446-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-447-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-451-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-477-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-479-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-480-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-481-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-483-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-482-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-478-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-450-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-460-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-461-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-462-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-464-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-466-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-469-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-468-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-471-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-472-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-473-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-474-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-475-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-470-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-465-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-452-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-453-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-454-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-455-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-456-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-457-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-458-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-459-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-448-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-449-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3724-445-0x000001DDB5480000-0x000001DDB5490000-memory.dmp

Download

memory/3844-352-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3844-543-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3976-405-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3976-313-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4100-90-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4100-296-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/4100-91-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4100-97-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4180-48-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4180-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4208-83-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4208-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-76-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4208-78-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/4384-335-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4384-328-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4384-442-0x0000000140000000-0x00000001401E3000-memory.dmp

Download

memory/4540-324-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4540-316-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4540-436-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4540-322-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4688-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4688-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4688-294-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4688-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4692-360-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4692-476-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4692-309-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4820-40-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4820-46-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4820-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-267-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-307-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5000-355-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5032-143-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/5032-115-0x0000000003FC0000-0x0000000004027000-memory.dmp

Download

memory/5032-0-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/5032-120-0x0000000003FC0000-0x0000000004027000-memory.dmp

Download

memory/5032-85-0x0000000000400000-0x00000000006E4000-memory.dmp

Download

memory/5032-16-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/5032-10-0x0000000002CA0000-0x0000000002D25000-memory.dmp

Download

memory/5032-8-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/5032-1-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download