9bdb459012a5dc9eee0e464c33957b71540bd879e970f052e54a72bf091cb27d

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.2MB
Sample261027-eka2sa1vez
SHA256 9bdb459012a5dc9eee0e464c33957b71540bd879e970f052e54a72bf091cb27d
MD5 e66931a9e4fc8d3bb94fdd071e46a4c4
SHA1 91714a08ed9a717229120490743a53ee81b4286f
SHA512 4ce4e6fbbb57608c867be06f9f587c0cf9146e5d6d0de9fa70b6fafb49830ea57405b38579a5f738e1ca3cda1c8fc3c4647834e02919f1117280269d4ea56a1b
SSDEEP 49152:1r4rJLcDmg27RnWGj5JO/UsUob/3kEIl+5:1aAD527BWG9MU1oz3FIU
TLSH
T1A1B52312B1D280F5E4B6493409E4EAB499BEBC710E244E7B37C62B2D6E755D08728F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4356	elevation_service.exe
2908	elevation_service.exe
2508	maintenanceservice.exe
3008	OSE.EXE
2788	PerceptionSimulationService.exe
3340	perfhost.exe
2956	locator.exe
2836	SensorDataService.exe
2532	snmptrap.exe
4660	spectrum.exe
1480	ssh-agent.exe
4128	TieringEngineService.exe
3712	AgentService.exe
4816	vds.exe
4544	vssvc.exe
3844	wbengine.exe
4256	WmiApSrv.exe
1904	SearchIndexer.exe
2224	alg.exe
4032	DiagnosticsHub.StandardCollector.Service.exe
1060	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a3d7d409b11239b.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-8-0x0000000000400000-0x0000000000B62000-memory.dmp	upx
behavioral1/files/0x0001000000017bd2-70.dat	upx
behavioral1/files/0x0001000000017049-69.dat	upx
behavioral1/files/0x000100000001700c-68.dat	upx
behavioral1/memory/3032-299-0x0000000000400000-0x0000000000B62000-memory.dmp	upx
behavioral1/files/0x000100000001700c-560.dat	upx
behavioral1/memory/2224-568-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x0001000000017bd2-574.dat	upx
behavioral1/memory/4032-590-0x0000000140000000-0x0000000140166000-memory.dmp	upx
behavioral1/memory/2224-638-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_126703\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f26b79ac765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000034d80299c765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001df03f9ac765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe29d398c765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060537d98c765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c08f1e9ac765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ca7b599c765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f16cba99c765dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc9b0799c765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060048e98c765dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4356	elevation_service.exe
4356	elevation_service.exe
4356	elevation_service.exe
4356	elevation_service.exe
4356	elevation_service.exe
4356	elevation_service.exe
4356	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe
2908	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3032	2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	4356	elevation_service.exe
Token: SeRestorePrivilege	4128	TieringEngineService.exe
Token: SeManageVolumePrivilege	4128	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3712	AgentService.exe
Token: SeBackupPrivilege	4544	vssvc.exe
Token: SeRestorePrivilege	4544	vssvc.exe
Token: SeAuditPrivilege	4544	vssvc.exe
Token: SeBackupPrivilege	3844	wbengine.exe
Token: SeRestorePrivilege	3844	wbengine.exe
Token: SeSecurityPrivilege	3844	wbengine.exe
Token: 33	1904	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1904	SearchIndexer.exe
Token: SeDebugPrivilege	4356	elevation_service.exe
Token: SeDebugPrivilege	2908	elevation_service.exe
Token: SeDebugPrivilege	2224	alg.exe
Token: SeDebugPrivilege	2224	alg.exe
Token: SeDebugPrivilege	2224	alg.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1984	1904	SearchIndexer.exe	108
PID 1904 wrote to memory of 2324	1904	SearchIndexer.exe	109
PID 1904 wrote to memory of 4752	1904	SearchIndexer.exe	118
PID 1904 wrote to memory of 2604	1904	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e66931a9e4fc8d3bb94fdd071e46a4c4_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3340

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2836

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2532

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4660

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4692

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1984
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4752
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:2604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:980

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f09b5ff2e8bef5be2591bd61587b9109f43dfab7c9e489304350ce9a1bfae87
MD5 275fbb267ceefd51a5c160e5a8c56d5c
SHA1 58ec69cc03b478fb0977ac51de652ce6e4db4112
SHA512 180fa809b82f338c9dd104613302e90334500fc6b511308e17290a4b6bc522a3d62114b77ad458048a6ad7e4f70bbdd17adae54b5e543cffbd45dd2d3de9c2e4
SSDEEP 49152:Zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEDmg27RnWGj:v3q6HjBTD527BWG
TLSH
T19BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 89915d5944d6acd23a0dd464e5274edf9caf1d20aae21154a4b8097bd9d1b1b4
MD5 8f00eafa5a33fe74319b245eb5022d3d
SHA1 913ce5e7da9f461849803185502c6c6ab68dfadd
SHA512 58312932aab96adcd15026f1e552a8890f2e28590ba759989db522d036996506138532c65f9afb715968b0f75bc5aa8544bda358b2dea940f29a48fff56b4653
SSDEEP 24576:DXYfDtczADsqjnhMgeiCl7G0nehbGZpbD:GtcSDmg27RnWGj
TLSH
T15D750129A3E408F9ED67817CC9A2C505EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.5MB
SHA256 cabdf453517f2cf078947bc14b8ef9f0f63341d54430ceea8d32923128502b2b
MD5 4b969383fd04bdaa442bb7250e8f0a00
SHA1 16cb877360272b7553cc0a54f90981570916d69f
SHA512 0391e3cb0d42629e568277d754369dc1eb6282f9627b67100034089c9866e9e34b7f42a15ccedbf0bf73d5b246ce8b0560fe4b9063a2a670a8a2b655ae7a6343
SSDEEP 49152:pPji0AYaDmg27RnWGjsJO/UsUob/3kEIl+5:JjoVD527BWGoMU1oz3FIU
TLSH
T19CC5E116F6748335D073C0B9C5D2A68EED7230865B308AC74286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 9b7f828abc9155f5fdd85e59b14c30006894ccf97253feb944d12a1bc12bec4c
MD5 5cd60bd39c49619c91784a1412e0580a
SHA1 f8a3f0000d4205db1dab48cea647da22e632db07
SHA512 3cd9d86f96cf3778ea7995fa3aa489f1d29c7ee2e9a5cdfd0f2f8e9a4a50a37260076329dc1e40de3467f81ce16f0fc369b9d8154f04335371124ddb2191ca81
SSDEEP 49152:T/ezSC6vUzPvxHjyGDmg27RnWGjtJO/UsUob/3kEIl+5:DezSC6v2XxHzD527BWGRMU1oz3FIU
TLSH
T121B5AF25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 bba3985c47e5fc63708f71243ce405b6ac3fbfec31c6b57d8711998f179f6090
MD5 820cba3272c3f8b6ad1768b6865eac0b
SHA1 2ac9ec5abd8605927666099490de1e0c6709f786
SHA512 600ef7319fe496bc7bf7ede4d6180d3b149a01c276d3c2e8c33d4304eed898d533f941e619314dd7edb5cd9ca403bdb8829af8a8865d94fa8cefd3a3d4a79bd8
SSDEEP 49152:RVO88hXl+HDmg27RnWGjJJO/UsUob/3kEIl+5:K/h1+HD527BWGNMU1oz3FIU
TLSH
T151A5D066F5B48331D073C0BAC5D2AA9EEE3234425B318ACB1246D76C3E67AD5C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.0MB
SHA256 b3b8baf3b6fe732b42e1011b6f773e6803fd374fc38a62e983ba414dfef962ba
MD5 cad3c299391444c6aed5c35ffbceefd0
SHA1 4fd6e348e35d271d40b41e33ba9ad6e68ba1bb94
SHA512 722cd118c9be00197e0a8aa72b548e267b08dbbd1525802351d238d5181edde302436856b5ee2e670df6e38ff9a16a5a923156512952789ce89f202794512ef9
SSDEEP 24576:qArsqjnhMgeiCl7G0nehbGZpbDjtJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:vDmg27RnWGjLtJO/UsUob/3kEIl+5
TLSH
T154A533ABC38C76CCFDB9DC75818EF19E98137CA699180C436A83399CB4768648768653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 2.3MB
SHA256 9dc3d0c6401267a8394bb9f9c73bb429c50d6d968a58634a8b225e3b60cabff3
MD5 6fd2eb0c82c61ee0d844b1118a9e852a
SHA1 b7747f374f0fe63909f0b56b1f3f7a6218fe9603
SHA512 fc40f5ea8c4cd10f21b0e51094a164f0d1d179a5fb1f72c236bb958862d66efe18310988d7251630fc2a3d3d4be9c4be00d7c2ec1dcf2db5df04cffba1031d9d
SSDEEP 49152:AJIUsDmg27RnWGjrJO/UsUob/3kEIl+5:rD527BWGvMU1oz3FIU
TLSH
T132B5017BEE28FCD2C67E9CB95691C240E76278714F2193CBE166820DDE235E04E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.4MB
SHA256 cff059282e35097ee28741e39d01d0b4d4be02e5aa29458428af8ea1c8538643
MD5 daf62fc1f6eed883ca87eb82fe8228ee
SHA1 7f64dff524a568e33c1bba50b84089b652839810
SHA512 ba00500124f388b4c8b37d3abdc552c595501800a1bde4659cd7112346ff84891d9e357674d926cc5ec123594b0b134931d417c8cf311cdaffaec9cd495fe59f
SSDEEP 98304:OQvGAdlCEL8c/3RNC5CRD527BWGbMU1oz3FIU:fvyEYc/33C8RVQBWGbMU1oz3R
TLSH
T131468D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9fa45699232c778f5b848cc46e4d13ec564f96592e9432936d26e4769f255586
MD5 da84caf55cc0ab61f0884fbe51f3fb7a
SHA1 15ddbccd3c7be850e3a41f8fa60d184450fd80f6
SHA512 76e956ad08239adcf778a32430b138d138f905a3ddb40a023dec54d4f6d637e569a45c4579e995d39a00e9ee0740a76768be3064efa67aaf6d6a18d5729c782d
SSDEEP 12288:TAwSfxL/2Dc3kDLLmt0LDQewsAjGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:M5ewsAjGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F75E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ed9af5a9abd6ec394f0ea51d43cbdd66db7f5a205d1ba21b2e55e3498c01c5a8
MD5 943f897ca6fd177094e8f9d1a4f10ad6
SHA1 54dbb6164f65b31726c75502f1517b50606ce5e8
SHA512 8c8c68987b9aea6091cb07f715449758f577ac97451469dc4a209065eeffecec138ee4bce3c7015c39cd48ec429145cbbadf1dd2334f94c873df6ef35a6ea649
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHCVQBWG:oUEtQevvqc2W1cpV2EI321B
TLSH
T15C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 815e25755f22a509d9762866f2eb7ac1ed44feb466ae52ca6fb28cd03166ae2b
MD5 83fb875a3b1e4cd24b66d991350a7278
SHA1 73f2f55c1a9d8f330367865fadc541f5682bd675
SHA512 a2f7d084b14bb8536f1ecb9dcb777de5ffd2df6e7643dedcbd33a1797cbe031718599f30320c577bf62ff4d6acc794697d8a9b3920fda0554565662826ae4e2b
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zqDmg27RnWGjdJO/UsUob/3kEIl+5:RoqtVjnmdD527BWG5MU1oz3FIU
TLSH
T171F5BF1976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE48E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 013d398a15bb01be393f5044927d67ba9c5c49334a40a730ef7948487a9bce80
MD5 b3fc897787e1545dfa508783d8f3480e
SHA1 ab20c642170e1c6febb7e32e988cc391426d32cb
SHA512 806558ea34dc2d43471bbf5828fa79fe87c2380da8c54bfb1a66e0cd54cef08552a23d0ce05772140f5705fb5c30f62b559ddb3215e9091de2f5673faaea59b5
SSDEEP 24576:PAhGLJIFoiwtA5l7S535sqjnhMgeiCl7G0nehbGZpbD:PAMyFoiq5NDmg27RnWGj
TLSH
T1D5359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 09dc0a9348787a48cc9b00f50c8f58ce542ebe67fa3646bfd88641abd362c48b
MD5 54e47d5075b12c123134989697ee899d
SHA1 17f913cc2095001f502a360cd633d4d43ddf7e35
SHA512 84ea5733d2f54ce08ada42347860ad770a407df371bc4a7c2a6ba75f865ea13025a6e82ea47a97dc67056ca6cef27226e51a4c23432faf0d847ec6cfad546ba6
SSDEEP 12288:imw5HEjsChNWBFgl0WDm+CdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:7wunOWisqjnhMgeiCl7G0nehbGZpbD
TLSH
T17075F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0443911cbb538990cff8e0be6c4e90dc93e3b3ce381c520b5e04b8a900e2de9e
MD5 17e2ea2d27279dd6475fe8fdcba55141
SHA1 fdbcc98a48eea5825e4540f0e79b4632c5f5e14c
SHA512 a3a9ae3985fc6a994075454d5b88a9007f8f5f256857618f227b151d747b21e1b6334e5333d7ab6a0ae0f06267f7312bea28ab42d109b8334154d0640bd54307
SSDEEP 12288:gGZ1Iy2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pZufsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1446512AA239820FAE163417CC5E5D609EB337C56673003CF166656AA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5ba14629c092c21d9234209939e4e4ff02904d188637e25d1997b7ed1426e838
MD5 fdea608f96dabaf41858dad1d3392308
SHA1 fc182d4d6bf98b5c3f8ec59d72ce1d80dcc3e118
SHA512 3012aa627c626d20daa4da565fb477ce26975678f3767bf0e002fc54cbea75626b2a8211b4d5429115df345333f2a6df7a8bcc470362303208dbcbc726619554
SSDEEP 98304:BQRQyi36YOcPQLvw2gAf+PN3YD527BWG:YQyiKayX+PNoVQBWG
TLSH
T1F2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c0c5d4c4493dfeddbbcbc47e35019ad5f089a8c163a9a19096a2aeab54d699c
MD5 349d9032a885fc39e69f35d3a6d44233
SHA1 191153f079736a3e9462ee146e04559aeabfe10d
SHA512 acec202193a592ff5e63a7e1b4ea3401b6b59089eb293c91b7b8ffab3f3761a2bc58e73dfd23d0f49f153aa273f05881850372023953e2d90e2538d5291a1cbe
SSDEEP 98304:1QRQyi36YOcPQLvw2gAf+PN3YD527BWG:MQyiKayX+PNoVQBWG
TLSH
T1BE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 932ddf39de31a99497ef1bb35a359790eca46f566ea10716707d1e8224d5ff46
MD5 a39a209c2e1ecae0e1b157a26a568d11
SHA1 bb188b42a2977ce36af48d0541678b891f43a950
SHA512 2894b50d152b25af06cbe21f0e6cf820905ae2fda7464a5c1bb71efe01313717f10a058718fe09f609b7977668f95b2f54ba00cfc49d5ce7b4dbe95d6e35c181
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vsqjnhMgeiCl7Ge:468Qg55nhheWu7PNU3/aDmg27RnWGj
TLSH
T129B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 deec754ed9df7f31a23d1e6cac2786e006ff2b9ad9ca2567fa9da83d7f8623aa
MD5 beb7476d8899b86d81227f037eb0b576
SHA1 ed29aa987b876f45a42ee9f570a5c5fad6932118
SHA512 78f37baee8a00c932307699c4d90e098fdde586bab7d37184b431dbca409c91206d77597d9476e636858da14f604296ea67434959203d827d0dc05e96c6aa121
SSDEEP 98304:Yy5112gYy5azzVvL69nLKnhZfD527BWG:xLIHmWhVVQBWG
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6990280a716422624a2088d7e3ee955627a7c600ae072ef927bbef75a15e8a1
MD5 07b2b063dac14bbefe38fc45f4913620
SHA1 699f222d5a96e5bbd695e57f28cca6e25a4e84c9
SHA512 ef551f57daa451656400acc993c97430357c7ce0fb3791303054d319a5a918cbf61fbda33f88134686fc136f906d920463bfd6cdbdbd4d97b6a3a372e348dccf
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXDmg27RnWGj:su6JmVxd2dXD527BWG
TLSH
T178D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3035f74da5faedcf7d7d00c92f299cd62c8712c729dbe68da1245ac127a67a8b
MD5 deb39159df006b845a7347fe5ef5b96c
SHA1 a451af5a8c3fbf2ed470e859b990e6bfb49bae21
SHA512 fea008d6941ad4321841d57e779ed863e28247410a16df46a463543e35cca169f69e59e5f1b88ba6fe48f26947cfcbb3526fc3fd5c6015a6c7a7ae892485224a
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xMDmg27RnWGj:amifPbRdD527BWG
TLSH
T170B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1e6637131ab4958371a422f7a991ba6cb3a79d6e7e6e89f9693713189c6078c2
MD5 742aef521f469d588d0104cd227509a0
SHA1 c7d08633792c9090b29cb9089966dedba36c356c
SHA512 413ffff768575f5b09b7713ca8fa9fdc4a2d04675042d38c255e10b7274ca284c7eea526a842a532d93cb0d62ed49a889e72dffd0962c4973ca4371040ec8e0d
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqDDmg27RnWGj:f5dKTi61DD527BWG
TLSH
T1C2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 efc6fb6508e5a7af273055b29c217547feba16fa113f65181aab71547ba5db96
MD5 b566d20a8e621ad8c0ab45fa482cd647
SHA1 081ba51af7b3b7ba0781d6475edc5f5e6151351e
SHA512 c4dcbff8bb12557db7c30314b8a4f3e2c4d9b2158f83978fb9cfedc920ea27fca406de78d52d83fe571bb3a57b6154319d89f89d795bca8264d02eb0fe354f2a
SSDEEP 49152:ChtSn8EApI0figngiDn0AP5wwDmg27RnWGj:jX2iyphJD527BWG
TLSH
T10395BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 72efafad19f5ee03aacc93d888943c6900b8d84e808413419cbfc00d05394aa2
MD5 eb58f4499b42595f8890e4d8b1c9d7d7
SHA1 d453dc584dd5d10bbc3e733cf6b6559d489c9b9c
SHA512 1b96bc711818dc9634adf4ce8adeb3a57ed1fba242b61bd0e49030cfd0058a35bc6501c14af1d56ffe91fc236f2c405b4d69b3cef0c9b31d8ae018558130d962
SSDEEP 12288:PDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB5523BE965C41CBE52644B5C3E9F10DAC073E5BE92004937A5B7CBEFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 095a817816dbd05b4e4a9197b6c4cfe078a980518c9671b29f5bf2b7742cb639
MD5 8bcda6f097a4c9df806dfd8e82efee06
SHA1 fbda1de39e2781ea5259672e3a666782f9b3810e
SHA512 12a232c13b01afdd2d834614ba535f19f78b146cdc20aa01073013a2e5334b7fb080c2a174bf4f411a723b6316e4fb16d1f76f66085010651d6355bdabf53c36
SSDEEP 12288:vKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1935523BE965C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAF7B24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 7b44590c946d5f34a88ffb6217fdc26c288678279bae0657fd88cf82ca2e6619
MD5 aa4b4dadb27e843cf7775beb0223ed70
SHA1 d3adbdd36354b9fd6f209f5cb08bf08a0fc77d0f
SHA512 e903108a730f76dd500509d29ba1e2e98d0077e8ffd1a76674d08ceda5a11b756301b5d6a7d388c6b894bf654bc2a7f654068ba3cc39ed23dee5a0b430e8b542
SSDEEP 12288:fIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1465523BE965C41CAE52604B5C3E5F14DEC173E5BE9200493BA9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c56bad5709a31471adffca96542112e0b6dbb009fa877522c93139d8bb34732f
MD5 0310dbbea823424e8125efcb9393e461
SHA1 c92554cd014e9ac160a74a50c7fe608a39e94efc
SHA512 dda23f62c3009288b59ca8d5f07e4729cf32eaffce9706672574bb68a9f19d5ff3085d091d54928e5394836ef303c2710086f95771da7c784bf296ba3735ac1d
SSDEEP 12288:iVZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10355236B575C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CEE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 8afd91d5092ca6f8fb38b507d6281906c02f36227211aff097cb4f6e56faf88b
MD5 bf45bf7c3a76b93f99c71656bbc630ba
SHA1 3150b98950c0abffd4fa7870c253c40390982db9
SHA512 6cb2262f28cc7a232cfe545be836bcdd1c0d216adf0df02b1dbe74cf13123d27037f1f9b01e748c0201380ee7cdb29c9bfad5e6ac3da39adb785fe455d070cac
SSDEEP 12288:IhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B5523BE965C41CBE52604B5C3E5F14DAC173E5BE9200483BA9B7CB9FBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 d1f60ded08f91b008de498fc4b84baee4bbcd4c26c705504ff896432653bade5
MD5 28068955329587cdbe0400dbf506dd32
SHA1 ec046931715f61881a0db1c3726d7f78ae21e249
SHA512 b60db9c94353a4152115c94e068e51dcdebf753de5ae76e45c4c54cb3a3be2dd2da0a3d1378b1a747e441a259923f14395ee427235667fe1bb436a3bddd5e23f
SSDEEP 12288:LeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB5523BE965C41CBE52644B5C3E5F14DAC073E5BE92004937A9B7CBAFBB24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 48e024213ef03f6c52419153d25e4ae2196356af791992c7356bcbda67aaf71a
MD5 024bb2f0f8b55fa4b4d5f3bd181de7d2
SHA1 c2f02fef431a629d4e11abb47e36ed497b5699e6
SHA512 11a8e7c9ba7ff4fe7f1e143227e4c4153b56dabd17a047e36a035d57913551d519555444891a00f3954a29ea5042791163fbc302111b43d73256efad6bc428c6
SSDEEP 12288:CyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CysqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E5523BE965C41CBE52644B5C3E9F14DAC073E5BE9200493BA5B7CBAF7B24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2af064fd528b6780a6bb8c095556f939c683303144fc66e819836246c6bb64b1
MD5 3a776b37a33757015870479f6c47b08f
SHA1 3231fa78dd89e73512402e5cde81865476bd8c98
SHA512 07bb11125e95ed7a533674d9c9d9e3d2da2ea252ddec64d70b69f2c58fc845f90528df3e9684efb20e3979ae495bdd69223f5176b62a1aedd2106d7f8b98c5d2
SSDEEP 24576:kZM2zFVSOqsqjnhMgeiCl7G0nehbGZpbD:kZM2zfiDmg27RnWGj
TLSH
T12B7501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 307df4c32450bcfa66df34b7f59ea2d88e7d4cbde4a61ffd7f054e7a5ebde15e
MD5 d7f4495384a133a9af46923b45dbea7d
SHA1 8073d37aa2a4a9d1bafd5a8ee70e35de6c87c48e
SHA512 2003b2a020a27e3acedf67efa48ef85b2e91db586ab6956588e5c5c0332d46e7adca4be5d557bdc94208b43f98e1f15c61c34ff930a39defa65a31c6e90f0f31
SSDEEP 12288:nPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD5523BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 e5a66ae794216ad71882b6251eb8bb014ef0d80e307720c75932c4b534887ea3
MD5 68376ccc2a8b19831192ed402c580a17
SHA1 bd25dc93b5da1458774f72f0e401a417cc36a1ed
SHA512 07a7ceb72abf8ab51a0344da3e481563d76e103482bad4a918e85ad255bfbf443050c9936c0df74a6969b8ce4eac02490e1e0e8cc604dc1b753b6ec46df23b7e
SSDEEP 12288:CbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10D5523BF965C41CAE62604B5C3E5F14DAC173E5BE9200483BA5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 6f3c09da4a172459f280438a0c3734a38709465cef9d8f97eecbfdba13b52d89
MD5 80929e8138da26a1195c2bfc6ca41a14
SHA1 9a0d5b9c60cb63b8f516b41b812a07d68667b901
SHA512 3d71b2fdbe9ca518d935573590a80a09dc3f3274594b847a5a4604cf32c67ea4f17d14dd07687a9e1d7ee02f255e780c46d1290738199888c630255fa94fdb6e
SSDEEP 49152:pP4m4IpOO6708KRDmg27RnWGj6JO/UsUob/3kEIl+5:fppOO1fD527BWGGMU1oz3FIU
TLSH
T184B5D02DA7DC0095D0BA917885658A4AFAB2742E2F3286CB1160937C7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bca1c7b63d7d8db07dba3a70ce40b6a5ba9b3c6e4fb3cdb557ddd20858743694
MD5 1175e4758444c8cde5a81df8312fde8c
SHA1 b38331abe53a13f101f568acc2aaa1a27bbbfad5
SHA512 d6867b840e2f2a52c0cd50c13ef61f3cd4b8b424b7153f8967356a4804c39df6acc7bafc5dbd84905a3fedf2970bd20124cce455d7cb623d470e8dbeba3bced5
SSDEEP 12288:wMsffXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:efsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D65015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 142fcac2bde97cc509cc586d1c20894922de12ce3c39aae67d54830512e712de
MD5 39f108df82d4fb329f62278fd04a8362
SHA1 410b36e5c7512d56f7a1f3c621ea5e03e138cb82
SHA512 96129e5a45273e2399ab1252d926c3c30addc82bb8427ddd5e92169d6b743811ba1777493df966d5ea8bba3647807441655f8ac6bea93dac38b173d7d5e61594
SSDEEP 12288:0/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C055237FD35C518BE53619B082E9E12D681B3E669E204483BA4738FDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2145488704407d725e345dacfd1fd899bbabf7b396d621c6b5e612f057ef0aa3
MD5 78fe4a2b072840d3ca2534712149dadc
SHA1 78619b6766720f2e56c4208e0036323384c29066
SHA512 336ece44219fcb4402c37723269a7363b334865242e81e3bfd7ee4500f479f8a8fa1287d949d49fc14a657fff3ff423be45b40b0ee64db243fc29603c3462734
SSDEEP 49152:Sa0h2GEkuAe73q3pp46zwwQ1Dmg27RnWGj:Sa0hNYG4JwCD527BWG
TLSH
T13D85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 08e9749a6a1cada3f93468330768a5ac4690f5433e27379929000e6b0bc36627
MD5 b258e451326fe6e67b56815599de49af
SHA1 f338d77040ae987a9077eb3aab922cebd8274c24
SHA512 076da4522b7e35908004fc2b746286462db4308cde4a254c75b5f6c4354b02e62f710a5e233603cc287b2fba7ad3e74bd46ce189874f8da8809b229efadb9f62
SSDEEP 24576:MhbHjPFJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkYfsqjnhMgeiCl7G0nehbGZd:MhbHjtJO/UsUob/3kEIl+5DDmg27RnWm
TLSH
T16B65227E42AC21C8F575E4BD818AD14AD632BC66171057EF2683917C6F3BEE40E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 af05c1c6179c2d8657157f2fd361082a00cbcbf9aa293ebb8679a6f5045d26e3
MD5 029a6db8689bf64f40b181fed64d1a3d
SHA1 660fd50628444bd4f122fdbebf03e0322adc5db5
SHA512 83673b70f90a94481b2baa29be1f24b48274cdd03cd80f60676271863173505275188f350932ba56898ed5756e6ad2fab963da9b975b1ac29b1b0dfa859815c1
SSDEEP 12288:jLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D5523BE925C51CAD93649B5C2E5E11DA8033E56AB2004D379A778FDF7B28D84B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8bf1a1dcc1b27720f4d0fe51e8ecd2fb1d359675b752c2e4e214f3fd5a85a437
MD5 8a3a7feb6c05a30d45f5a62dc40ee102
SHA1 bf3fe5bf1b6c6bad00cd9d72e8932ebaf550661d
SHA512 8b9c1fb008c0a991b9a7901949ab3f5b8d60bbe8f79a7ad401b20dff96863ba6f502c646a414d97cf8d060d63f76af9a4f2e0db34cdd3be57ddb3d30b8d69492
SSDEEP 12288:jObYA4LWOsvAYFTUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:MQL3UTUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C0750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bec9045d6cf24e6dec2b5a89177ea88f452940c8094851ba4090c51cfdd1bbf1
MD5 f0ef84b83a29c793615698a55d128cf0
SHA1 40cc3e69be1604f6289efc201eaaedec47771699
SHA512 40487ee36da515d646a627f0c1740e9a83e908461246d6dbd71bfe2b91c48705fcdd9223cddec490812c288646ed795cf020e73fd5df60b0dba0af9327275fa6
SSDEEP 12288:gpFtiOQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pOQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A65022E33EC10E9E536917C8692D20DD6327C660B2117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b573ed85c1471fce8cde599e618769a6aea95082af0efa6de16a68e07cdfd7e5
MD5 3ee8453a61cab2eac67ff3e5c9fd1c2c
SHA1 c0a6c7e3573448d331bcc0df4879f5d803277e83
SHA512 81b7cc3a41c8b6880ccc00941e17e000ef17fd16129d8ff495dcd2b4fc49d21fa55d651d4773b1b049b0a8e882227e5a85b366213169a3bdc0d46b26ac3fac15
SSDEEP 24576:87NM9YqZqmWMUkPjZM48Mv6bEhsPsqjnhMgeiCl7G0nehbGZpbD:87cBWMpPjN8DbEhODmg27RnWGj
TLSH
T182659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 6e378d9015b24aecbef99f0c58fdf1b78c0d19d5983321cd12602dd2d9d1a943
MD5 f4f2dfdf8a1ee46ec159a764959f8a79
SHA1 a7694f99d30607dd10d5baf362bebb34d312071e
SHA512 f36fc0da128b960a76b7505e53056249fbd05513f710505fa5e6dbdb55ca952ece2615f893c1323e4657d7de26b51902fc969baf7cdde6289d6ad11252de45ce
SSDEEP 24576:eW6BApg2YuyuNDYTabvcdvNYf8km1lsqjnhMgeiCl7G0nehbGZpbD:eF2YuHNETovAvNYf8kmTDmg27RnWGj
TLSH
T18B857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 934258e4346a9180d8b8a6c72b9c2b8855855250d1f76fd2aef39dd6f5715eb2
MD5 3b9bfa96668209d42bb37100718c8c43
SHA1 d7736f0ac05bb2f95d293672aac661ba0bd407de
SHA512 bb54a1f2051126e41ae4a5d14269d4a26916c52d111a812f995f0024c67f4ef9dae370465e8e9fa49441f931fef8c6562eabb42a507b9f3e8a96095efa3f2d91
SSDEEP 49152:eF2YuHNETovevNYf8kmTDmg27RnWGjhJO/UsUob/3kEIl+5:P6jCf8kMD527BWGNMU1oz3FIU
TLSH
T18EC5BF6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CB0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2badcbe75afd2b975892e935bcb77d2755ad997b027cee06d987134e9c62678c
MD5 ca1dca91ee1b84d6473b29478b8c4523
SHA1 1d2d00205ce1d2cc5b5b2cd24bbca30e26105bab
SHA512 c9ecc2d843bb32ae8fec916f73c3c02d2fc5a4ff14678d1c70ea15107971bf5d000ffb884fd5edb4b06eaa5ce0586b4496f11bb5b6bf7a2db55a105e98d4c8de
SSDEEP 24576:MAFs06+Omlf3NXEbToMsqjnhMgeiCl7G0nehbGZpbD:hFs060lVXuVDmg27RnWGj
TLSH
T17365AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 9996d8b2d8539354c12c48f9bf0b9c169548125e72f47486eae5758474a65c28
MD5 c035d048bb06421dfd54a3e7813b2be8
SHA1 c3aa8f99434d7c40cb594100c5a0f7137c396711
SHA512 25f772346bee57429f6820ce8f822f6b222665746229904b2c6c860c7bae21be2293230a408e8acbfd90af4833901e871c143dec0e8bbcde7c52e843b28cc6e8
SSDEEP 24576:xJnJ5D3WzBsqjnhMgeiCl7G0nehbGZpbD:xJnJ5DGzVDmg27RnWGj
TLSH
T1C075E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8c2a57b2801c65d310cedc80cc33c9314a1e73aa0c08005872498ae931f54234
MD5 98b9f56e717d36f4764a7692606eb0f0
SHA1 e72fdf9b45bf5a4f2c5c98e24091fc8bda01c116
SHA512 b4395dad72f27d4bc08cf9e622656a19a2fa985f110d89457b0e5a75438a0ef93d687633a80e9a762039acb59f02518469f6c42592dad629a01890ed8acde2ad
SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3VuisqjnhMgeiCl7G0nehbGZpbD:jg06DIKdwc+eQnSt65aVHDmg27RnWGj
TLSH
T1C9955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 567f5e31020e29eb070bd05e91e41c232e2725b8f9ec61de4afa40d4e594717b
MD5 dee8adcbef098656f5a6efc4260b0b68
SHA1 707da061cd44c5f60f87d07ce505904ff54873a1
SHA512 5ba9132f8c0a067068f99af3ea2d521a8ea84f7455342cbc8a6d113cc6aee69a817ad783565aa29e2c00c9cfcb0ffe2dfd1ff85d8178e095e3e24aac06b39fa3
SSDEEP 24576:tpoJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkYfsqjnhMgeiCl7G0nehbGZpbD:tpoJO/UsUob/3kEIl+5DDmg27RnWGj
TLSH
T19665236E579C70D8E43AE47D8185C249D333B8756B121BEB26C2A17C9E779E80E3CB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 e45d0f670c8742f8515c64334e0ef945098c83249004cb45d9f3e80e5ac2914a
MD5 8e7b37cc60eba3524784ee0cd56c9ade
SHA1 cfd9a8b9930d0c2b333bb9702fa23f8593ecbba4
SHA512 6ec6f0b05efe6023863822b6e69a2097b655c5df27c138dbe0150d83a3a5e09e3401dda651746d66650ad4d114119cd90f3ca7d70792fa36f14fbffb80be9bcc
SSDEEP 24576:0ioJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:0ioJO/UsUob/3kEIl+5
TLSH
T1C705126E67DC70E8E479E03D8485C249D372F4752B562BEF16C2823C5E27AE42E38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.2MB
SHA256 a2456c2f860dc3b0c80951f9de39f41d5536fd7d896aa4808f75371f78378e28
MD5 1e14ce76dedd760d845e7e77d569563f
SHA1 1026ac83201f5a76bb74011aa8a0e99c67a72fa8
SHA512 d92b014d85d799e662ef79683a90f3f3607af91325dffecc6562deee515fe04322b673b816e68a9216305e1cb0d0d79345f0ccb2bfa8912a1c3063b5084d858a
SSDEEP 24576:SIypsqjnhMgeiCl7G0nehbGZpbDnsqjnhMgeiCl7G0nehbGZpbD:SIeDmg27RnWGjzDmg27RnWGj
TLSH
T18D55236D538C50C9E9760578C2E6E15CAC237C21AF2005DB6592F97EBF72AD44E38B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 708KB
SHA256 7b1d07862fe438865eda9b5b22ad86fa70a8e8ec108d00501b3fd8cfe3a3591e
MD5 543dd7be11dde6b6da78bd49e25a439c
SHA1 074104cdad17dafe47b429501c10c0bb287edf1b
SHA512 8560cd15e83ec107ef2b270781f11659ff0db85649c1134f3f9a8686796627998a85dd663d0012e74fe0f0b83bbfedcfa7a7fde534585a4c197e3a59ddda1da8
SSDEEP 12288:7jkypXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7IypsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DDF42219639C60C9EA760578C6B3D1989C36BC319F2046DF6191FA3EAF72BD44E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 ab21f7e76c012043bbdf2db8ff419684705465d5025f5055ed0467e144e5c10a
MD5 b9fc5318054298cefc6d610c3bf2f69f
SHA1 454e8f99feb0ec87786542a4fba824c30c6ccee3
SHA512 1481ae698de39fb5129979659b73b7142ff55250021c778358b3db7a2678e430fd4e4a98a8e468ff2e25539c08fd832936069aa71d60b2328579762abac7c720
SSDEEP 12288:knAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14155237E525C60CEE93245B8C3E5E50D98133D76AB2014E779E7B8BDEBB24D44B38812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 90ff6030b3d4f0feeef3933a85991602cc54a9f245bbc940e7d0e5cafc4c39c4
MD5 b3ea4ec79d7d813d81beb7008c6627f0
SHA1 e16d29dffad8e1f9dc548fa0592f40a63bce87d1
SHA512 dc43ea47bc49c633d2c1e5c18ec35a9ec0075fc1053a33f16659476f766c21d4125f4166c779a60fdaa2dce830749cbddd805e8efda8835d9d692e57562d5bcd
SSDEEP 24576:yQ9MxZKdcz9dw3nsqjnhMgeiCl7G0nehbGZpbD:yVKZ7Dmg27RnWGj
TLSH
T1FB558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 8dcbeda6baf9ee7e9351f4258a0a110a82356dcb7f83e34143022a47afd63ebf
MD5 1e3f4115f872255fb0e199cce8defeab
SHA1 6b5a54f045f7b9ccb56337ba0bb279894f733cbe
SHA512 d698e7f55463e909a7164a3d826ca4e98843bd1161df7ad2870a9d1a2f00db1c93307361d228e96a4b2d13e95291c7d44d84702703342d7c184e39408156824a
SSDEEP 12288:eyoKo2URple9pGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:eyocyApGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE65E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 30b56dc58a62d8ca50a9a7bbc7701f25cfba74a7241bcee6e617d212f2c07103
MD5 bbded09546fd21c6d155ddc05d8100a5
SHA1 a864cde6970c72717d599997490c4fc249f24b8e
SHA512 f2dc399c72dd2239a33c2bf1c34da67e547be8032d0186ee53aa470413ebd601122080d56743a09308f9a48c4252adb8756a29a2be499ad6c895f4e06b77ebfe
SSDEEP 49152:rWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKKDmg27RnWGj:b0zuNIwD527BWG
TLSH
T1F3A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 ce57401e14a27de5b4dd966c3f3b6e8d600f3541118d43e8fa031e84d5249710
MD5 65aaf298a5cb1671026c800429dbf532
SHA1 f1d4ef116c3b2b2489549d9e2cd0c98dd659da12
SHA512 3323ebff25a9bc1b51e63a3f81fe1f3c773dda5efb1821023a298487ba6e76d0d1bafd8f1948e3ce32006970a73e4ebc50e50f914be4392f60c2a559103a09bc
SSDEEP 49152:Sa0h2GEkuAe73q3ppj6zwwQ1Dmg27RnWGjtJO/UsUob/3kEIl+5:Sa0hNYGjJwCD527BWGpMU1oz3FIU
TLSH
T18BC5D01E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 912a47e2541075ea863a439ed1d5ebb9f9b2956c09f9a827c9b8d9b4df3b83bb
MD5 dfe6e1a72791fc044c58286b843ad09d
SHA1 051e5b3c16021d8318bbf00edea2a5f4d122d4aa
SHA512 745fe3c7db60ec44cb62fd2116bba013c31e8dae86b82084022ee3a4d95388d9dfec6e7314eef0a67b033fc010828467e02be7c2792298882ad7406eda258cac
SSDEEP 24576:A1QT7EcpfxR+N5AWAz3ooiYhjMqbKJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:9TDxR+N5YzTTjMtJO/UsUob/3kEIl+5
TLSH
T15C75C12EA7F815E9D1BEC5799A23C512FB727821033193CB42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 849KB
SHA256 27ee33d0664f714417e04402b3857228f7194ed53b159a8cb330e930493030bf
MD5 1b05c519b7031ec90faa3c0a63ea895f
SHA1 04930529cd6c200e5c87ebdcf6e089e2a43acc21
SHA512 18f6b52e008c110ba644074f8ae608730816544ffdec9fa90333ab411abe94e0040ee34c97e8432b4eb5f4f617907ab0a713878462f1b07d690636a161d152c3
SSDEEP 24576:xhbHjPFJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:xhbHjtJO/UsUob/3kEIl+5
TLSH
T10205126E56EC25D8F5B5E47D8446824AC332BC26171697EF23C282781F2BEE41D74F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 2.3MB
SHA256 d1c6bb1f0549e3266ba253375da847a0a22971900decaa277a95036ff6879e71
MD5 559ae98c88968411f1f5f7ede0b3aad6
SHA1 5eb38859d12e0ff5d6a7ede72d59ac33ec67766d
SHA512 3848377c8b342741b05abd7b246f051d17ed87f661e55e0ae60fe67057fd734148183c25124944336823de452bf5b410192fbec7e2a901a7f5b628894392aa25
SSDEEP 49152:o0K+VmSLdDmg27RnWGjyJO/UsUob/3kEIl+5:ZtD527BWGGMU1oz3FIU
TLSH
T1FCB5127EA3AD14E8E47AC17DC647D90AE573386603216AD706D1C0B93F5BEE42A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a3d7d409b11239b.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\7a3d7d409b11239b.bin
Size 12KB
SHA256 d9a0fb4f368dfeb7a5dbcdb03f5c4eb5804aa3f165171c0d509ce191af5b3c9e
MD5 520b176fee748f468c05affdf4a79181
SHA1 a528291a8f89932ed3207b02ef8848d89e529e5f
SHA512 09cde2b6b4c7be6a4481a9e21661b634250f0403f3746b7dbe14379a3c1c8c16d6ba4d280b8fac0081162e7ec97e3b381cf8081fa4e9f0a6ed61745f661c3e72
SSDEEP 192:wVq1LGzyzLMWy60rZG9+cHfC+ffnlk8sOuY2xPmEnq65OOE3X4iO6LhoQzQoE:wVkGmUQSZkH5PeZN5u3XjO6OQ0oE
TLSH
T14442C043155DC723F35C908F87173EF802DA4697E21B25589DF892F0EE61096489FB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.9MB
SHA256 c2b4a040c99ab3109bf2865ee027138853e4058f974a8186e2807b7d9b2abde4
MD5 9db3fb501ff37bbfee7734e47ef39ef1
SHA1 82a9d990b0e9c081f702f2ccd45a634d8330127e
SHA512 9c276c97d739f24c0ee6e9c1d2347630f7822ee3fac165c2bec00bed1fea8bc57ead080adf9c80c24e14254a1f2cfe97c8f6b40c379eacf16d9f53c7c017310c
SSDEEP 49152:oIgnaTk46pBR/kDmg27RnWGjSJO/UsUob/3kEIl+5:o3uD527BWGuMU1oz3FIU
TLSH
T16E95E12EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 2.1MB
SHA256 570ac8a4a9c6f16b4750e9e901eab520b12f954a37e5ce7d8a84b9fe71e61d43
MD5 63961e4af73bbb4ec1c0039d2b824c8f
SHA1 d05f7fc6f9057cf71e5f001adb3be57756515f6d
SHA512 c2875fd0699ece476bf4920d6b44f310f298075e4e46e6587777a030445cf4cb31c900fc3a66f99637baf5b81eed432e3b7f2c504bd6fcaacde0a9771c5315a2
SSDEEP 24576:+UsqjnhMgeiCl7G0nehbGZpbDZJO2bFtiUs6AwVTib/0eBO/lEI4c+z+s3BkY:+wDmg27RnWGjhJO/UsUob/3kEIl+5
TLSH
T1A7A5235E83DC30C8F875D875825AD259C5227C7627241AFF39C2E97CAB379D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-613-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/1480-311-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1480-135-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1480-129-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1904-318-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1904-161-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1904-355-0x000000000B9C0000-0x000000000B9C8000-memory.dmp

Download

memory/1904-194-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1904-177-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1904-544-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2224-638-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2224-568-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/2324-369-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-357-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-366-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-359-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-368-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-372-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-371-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-370-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-367-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-365-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-364-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-373-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-374-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-375-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-378-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-377-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-376-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-383-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-384-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-385-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-388-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-387-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-386-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-382-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-381-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-380-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-379-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-358-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-363-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-398-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-397-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-395-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-396-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-394-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-393-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-392-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-391-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-360-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-361-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2324-362-0x000001E472130000-0x000001E472140000-memory.dmp

Download

memory/2508-78-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/2508-57-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2508-63-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2508-76-0x0000000001690000-0x00000000016F0000-memory.dmp

Download

memory/2532-309-0x0000000140000000-0x000000014014B000-memory.dmp

Download

memory/2788-92-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2788-98-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/2788-320-0x0000000140000000-0x0000000140160000-memory.dmp

Download

memory/2836-306-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2836-389-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2908-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-535-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2908-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2908-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2956-304-0x0000000140000000-0x000000014014A000-memory.dmp

Download

memory/3008-319-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/3008-82-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3008-88-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3032-8-0x0000000000400000-0x0000000000B62000-memory.dmp

Download

memory/3032-299-0x0000000000400000-0x0000000000B62000-memory.dmp

Download

memory/3032-20-0x0000000003680000-0x00000000036E7000-memory.dmp

Download

memory/3032-0-0x0000000002750000-0x00000000028C4000-memory.dmp

Download

memory/3032-1-0x00000000029F0000-0x0000000002A75000-memory.dmp

Download

memory/3032-14-0x0000000003680000-0x00000000036E7000-memory.dmp

Download

memory/3032-6-0x00000000029F0000-0x0000000002A75000-memory.dmp

Download

memory/3340-300-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/3340-102-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/3340-107-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/3712-142-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3844-316-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4032-590-0x0000000140000000-0x0000000140166000-memory.dmp

Download

memory/4128-313-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4256-317-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/4356-390-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4356-43-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4356-33-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4356-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4544-315-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4660-124-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4660-118-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/4660-310-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4816-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download