1264bffe2390eb24ff5dbc65f2f8a96e3616c77c596bb9b96178317d84168873

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Size 3.0MB
Sample261030-a1pgwsch65
SHA256 1264bffe2390eb24ff5dbc65f2f8a96e3616c77c596bb9b96178317d84168873
MD5 848a878a7a933ffa3fa67ec77ead95fc
SHA1 8792ad42ef0be073add6ba60f1c4c19beb39984b
SHA512 89593cd867708e3078141ff5ed03c8cf82ba86f8f005423a080d3fb7c99dcbfef6da21175516a92cfb1bf9da6f6da934de6d4ed416a600559666d78fe147a16f
SSDEEP 49152:ZQv8Wxr7u2guTjfmF6JYTiGDmXarSj8RoTCC6TjfmF6JYTiGDm:9Wxr7uSjS6J0i6mXJTIjS6J0i6m
TLSH
T147E51211FB84E032C26331741B66EBB9296DBDB05B26968377D43E7E2D301C05A3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4864	alg.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
820	fxssvc.exe
4740	elevation_service.exe
1928	elevation_service.exe
2084	maintenanceservice.exe
1084	msdtc.exe
2964	OSE.EXE
3964	PerceptionSimulationService.exe
3608	perfhost.exe
4388	locator.exe
848	SensorDataService.exe
4636	snmptrap.exe
1640	spectrum.exe
4008	ssh-agent.exe
1908	TieringEngineService.exe
3508	AgentService.exe
1672	vds.exe
1004	vssvc.exe
3080	wbengine.exe
624	WmiApSrv.exe
4512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dba7f3b288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a4ec85f0768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3ae8f610768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fc79f5f0768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b23899610768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0d012620768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000924bac610768dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4504	DiagnosticsHub.StandardCollector.Service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4952	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Token: SeAuditPrivilege	820	fxssvc.exe
Token: SeRestorePrivilege	1908	TieringEngineService.exe
Token: SeManageVolumePrivilege	1908	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3508	AgentService.exe
Token: SeBackupPrivilege	1004	vssvc.exe
Token: SeRestorePrivilege	1004	vssvc.exe
Token: SeAuditPrivilege	1004	vssvc.exe
Token: SeBackupPrivilege	3080	wbengine.exe
Token: SeRestorePrivilege	3080	wbengine.exe
Token: SeSecurityPrivilege	3080	wbengine.exe
Token: 33	4512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeDebugPrivilege	4504	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4740	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4952	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
4952	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
4952	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4324	4512	SearchIndexer.exe	110
PID 4512 wrote to memory of 4344	4512	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3740

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1928

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2084

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3608

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:848

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4636

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4052

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3080

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f88c7f6cb65b337707e95169ddc981012fcd56aaaa311b611de586b19cbd0d85
MD5 51a94789f4caf0f50294be24f124edd8
SHA1 d9f959596e7fe35b49b9bcc227fe2c3b2f4d3439
SHA512 b3d611e6f2e3bf9f72a795e653c2b6a33ea60a942c0799dc6e7f87d1d986aae26714c01825de6e522414a1e9a4c09ef659997204054cad2ff0868b3475f93b4e
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnNTjfmF6JYTiGDm:D3q6HjB8jS6J0i6m
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e7bd7947313493459963a5d0e49eb323b4ee09c9cc2ba20a2abe6a15608593c1
MD5 c1d59d14d5399e9206b6468434bab6e3
SHA1 0438f75674878cf1f1e945b818061eb2b8ec8a88
SHA512 b6f1e839e4b6a91897930129b7c56f8731e07f9761a92a768ee7c88b14b2444828bdf513b04d42a6fddf29a981e316b299966c11981c0e5d36174bd6118f8899
SSDEEP 24576:KXYfDtczA+vrjfnmUWpEJcvTiGdtmOyggu:RtcvTjfmF6JYTiGDm
TLSH
T1EC65F124B7E548F9ED67813DC8A28511EA3378904760E7CB03E4996A5F333C85E3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 01507425fc78d1044c68e6e7df153c7137f8fdff075869b97478284fb7532ad3
MD5 8dca324c716f9a4a26b2d4d7ee3eac33
SHA1 ffde7079e95c894ed8b6f0df1880f8ccd67a81eb
SHA512 3030d79827c753e81527ada6ce701b6e5ab95bb607ea10eb83581d616633faa74e27010b4e3422fcce432c9b067cef8bfc5d6f9ee0fc77a237242ebfbcd7094d
SSDEEP 24576:k0Le5ji0hmxirM1vrjfnmUWpEJcvTiGdtmOyggM:kPji0Ac8TjfmF6JYTiGDm
TLSH
T1D6859E16F6788331D073C0B9C5D2A69AED7130815B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0fa43ba163560d4799a32ec6caa3c7624c4e31fabf4396596219d06802d1ee98
MD5 d225ac1df54dd25b69e1171a881a1f76
SHA1 3d9e3d4dba475bd3fda6cf3ec2d11ad5d2c8ddb9
SHA512 758628ebffeebcd50ebdb60406f550010bea6616518e0346648b39b77e31269ec1f1af18403ae23335b3127cd0d9ddc0d1d5dc0b175b47bddff7c2a0c17b2169
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyufvrjfnmUWpEJcvTiGdtmOyggG:u/ezSC6vUzPvxHjyQTjfmF6JYTiGDm
TLSH
T1CE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4845d0ab4b65a93436222e0eccb5d7de708dc5066476c0e5ef8011f3ba60cba8
MD5 963510a62ae4950abf5aa164cd9ccb12
SHA1 78a09ab113d563e7bf12bfe2e42e7d3aba000a96
SHA512 7257ac1b5e8a157bfeafa7aedb37b63bcfe05e342a06345896359058e24c1370887cc9e6a5af4fda422b12f3e73ba978722ebb9154d1b8d93be6b319cb56b32b
SSDEEP 24576:cVbqPb88hv/l+6qvrjfnmUWpEJcvTiGdtmOyggI:cVO88hXl+5TjfmF6JYTiGDm
TLSH
T1B8559E66F5B48331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fef85528d2b18aace8b6d582e47970e059a1235521ec1daba89be7cd5063396f
MD5 9af5dce5414ee672910fbff50378c0d5
SHA1 d4154389fb3fbda82715506258e854e742972d98
SHA512 6b005a5f6215ba1a13a5c7969ec174af7c0576298dff8ab6f71bb087495c63e575a4d2e07ca220ace989ca0d113c8071334bf0c663e98a5114eb875ea723b281
SSDEEP 12288:gRxFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcE:gRxvrjfnmUWpEJcvTiGdtmOyggr
TLSH
T1AF452341DCA9F412D7A720353992AD451D699CE04963D9C02AE83E6E943C2C8C7DFECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1f44d81ba14bbfa5e3bed80f77203354ec5cef7ae6c29490ee8956b179f4f1e2
MD5 398174b036b0649449975deb9a91320e
SHA1 ba5b01c79e2c7cb380323b331e27f2ed136cb55f
SHA512 ee869420192f986b9d2b62b6f56571e1fcac1583765253298c782d0ccf54237f4e4f2697441614f16a12c8af59bae38bac77ed41c9f418c2fc2f83c272abac0c
SSDEEP 12288:yeBNUbTVO86UyFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5h+:yJIUyvrjfnmUWpEJcvTiGdtmOyggm
TLSH
T1DC65CF3BEE28FCD2C27A9D795A91C600977278704F62A3CBD174820EDE235D45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 aa572c887c6bac113175ceb85cd17502d136c8d3a88580c502711528dd1e3d8f
MD5 0d2e619d3a6303dc0a8e4541c14b8a69
SHA1 bcd6c1985caf0bbd45aed3aeeb2ad345b04184ef
SHA512 3b727136c83003bcd3164eb9c1a4c2f10be3ab800d2215bf036e0fa29f42b39b4c2a3ae83fb667610b8f5ca95d5d85419792640a1d11c201430604c458fb3b3d
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THg:UQvGAdlCEL8c/yRNw5C7jS6J0i6m
TLSH
T1D6267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 164cd7a51a8e81441c7735b20f7e5930f0aad2638db994142f654fb77eb7c33d
MD5 25931333a731767a212479cf9f8200e5
SHA1 741720823fd15d53a7d7d82ebb11508f422d2f99
SHA512 2e04e34bd5a8c14086d5463d605968fbca1ea62aef3043af1e20a946a43d9186f0d5bac9888b6b4fbca81f45b08383af52ec3abde3537d5c4fd4d12def83a6f0
SSDEEP 24576:QdewsAjsvrjfnmUWpEJcvTiGdtmOyggX:gljsTjfmF6JYTiGDm
TLSH
T15575E031FE74E032C3BB0DB62B26D716182D79604B6219C3E3E85D9E59342D22776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f7f0984fd197291a935e6b3ece4b2134bfcb1c572374d814dcf7ef118aa85fbc
MD5 bab374b324ee980d11367297f65a0a07
SHA1 c02c4a7a44080d12d3161a030f454266d7b179f7
SHA512 c21bd487cd85d6e1c8a1ff0e758deb062b7cc15ba1f3bc1667ea304c56817cdfe43317f58c94cd441f7b10d232c0d8426b14d9314174db26bdc75918feeba979
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJdm:lUEtQevvqc2W1cpV2EI32j
TLSH
T18E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 da4961dc5fe4435e88a50b1344aa3694eca4614f736ff3c1c96014be8e8dda60
MD5 63e3affc7624e55c93cbada9809e8adb
SHA1 d39566a3bf98f64ca254037cbd589eb69ec98746
SHA512 185bf73f8b12f4b6a2e00e9d8c36b3054b42e8c76c1633dd2f12a2cd0a90d90a25b311f71bbf9166980386451a384a2828f3f2fe99bc451a74fc0ff1b96ff3bf
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/zMTjfmF6JYTiGDm:roqtVjnm3jS6J0i6m
TLSH
T171D58D0976B8C2E4D1F6C37896A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 39f57e01357ed8cf62ddd9ffb0a19c9fd950ac9376f7bb45a08fe5705ff365f8
MD5 62340b143c07ec426f7b90a4f19484e4
SHA1 f01e3b0a7446ba99a62cec04e4da29db0d77c0fa
SHA512 1583306e47e87b0038e7a1987caa3ca133976f2eb866b9ffe78151a4e4ea631321e257363b312d4866f3f7263ac1c7bdc7c8d7223a1527e9800cac0c0846fe1b
SSDEEP 24576:kAhGLJIFoiwtA5l7S53zvrjfnmUWpEJcvTiGdtmOyggZ:kAMyFoiq5DTjfmF6JYTiGDm
TLSH
T10A35AD80EBF955D4F5B3AA7899B69570EA76BCA55E31C20F2160D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 49e36575008491e96fa5bcd31ee5d7d3f0c77c77f04371d32f0137304af23f2b
MD5 ede47d826947d8b678f1db9dfbc758c5
SHA1 326ad507fc22a45354bf5a8bbe464d428dbd57e0
SHA512 aa273a5ec3fd8ebda98688152c3f1e60a9dbd961f3c72819434c5543d290c62bfcbf51142de2db8d8ba838c7e5d7917e56899fc0a1b40834392ff10c926b5dc7
SSDEEP 12288:tmw5HEjsChNVBFgl0WDm+C/FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWh:IwuoOWwvrjfnmUWpEJcvTiGdtmOyggz
TLSH
T1A265F14676A81CF9EAA741388553C536F7B2BC112A21DB1F17A0C65F5F37350AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 93a2edd8623afcde38015c4b8d247faf6b4cfbcabd49dfc3765e6675a6a97048
MD5 ef0e57ec7302088f65f8ab3bbc06f79d
SHA1 e1e5f7d8cd3884a16a618d7a8efcb427945b738c
SHA512 2e24a98255f902079fffe1f19318c00f62e04d5ea9cf0ef6cc2c24316e8a3ada754a8e5e889edb5e97180965c3c06819daa46886e1b668c7d6eda2857eaa7188
SSDEEP 12288:NBZ1IycFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcg:rZu9vrjfnmUWpEJcvTiGdtmOyggb
TLSH
T1335512453AE8B0B6D3A3513C9DE15A05DB7178A01732C3CF16A41A6E5F36AC44F3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 21b5cf29fe0a88e2e4b704b5c11763e2c395ea272582eb7ccb805318c5e7fdeb
MD5 3d473b98780402b1f7965dd0def3d820
SHA1 c1aa130ec58cbd30a842efc9b7f6508071dc0799
SHA512 0770157e2591e1437d8cdd4cb2a8cdcceee478b44df13093bc1852ea942d122dea8d27873e5d4e3da5dea9d74353691fc1992ac9fa51c05d7c4192c6ae65e590
SSDEEP 98304:GQRQyi36YOcPQLvw2gAf+PN3QjS6J0i6m:tQyiKayX+PN/dm
TLSH
T16E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d99eab9aad24fc3f94e17c12bdb72d563f7fe5567861f1ed32c4c449a768fec0
MD5 83f4230da66d094f0ec4464bdad9cf2f
SHA1 b44b41d785842b12e3899b87e8c146d5894059fe
SHA512 d2a62f1d4bcb20c8717ce7cbc5d1cbdece3cff3ee11b360a88695e93d5452c002d4496fdea14597eb19ac3d4f05a5cc438a1e6c08c7fc1a38fb62ef1be17fb9b
SSDEEP 98304:aQRQyi36YOcPQLvw2gAf+PN3QjS6J0i6m:RQyiKayX+PN/dm
TLSH
T1A1667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aead8dc44035108ee6188eb457b523d22eb63985ee60eb3642542e4c28a8efef
MD5 b29b27be640d96a45758dafb6d1f6b3e
SHA1 447d8acd3ad7938e47b349571c0d99f60ebb30f0
SHA512 68b6ce670885fdfc6cb35bfbe555361e30ecb2d8e055b57e6b47205613fbbbbc4f700ef5391322a4ab91fb0531fc837443a6ae56cafc350f6e1254350f2c4b86
SSDEEP 49152:F68Qg55nhheWu7PNU3/8TjfmF6JYTiGDm:TthWRc/+jS6J0i6m
TLSH
T19BB55A33B2F600A9C44DE1769F4A873196D17C718FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4dd42a651eb20b6f0c69ed31e229bfde107ffd6dfc4db306562af50e0efed56f
MD5 a06d43338261201d50f3c397a8661522
SHA1 e5d2f21a1855597ff87b0043351cca39e7ab3dc2
SHA512 e20a6635713f44481916befa3baf13b3d020030e4ed3fb5e36252aa40420bd9344812b7cd904d25f90f16800bb179aa46679f887122c6ae447e284cafa7159e0
SSDEEP 98304:8y5112gYy5azzVvL69nLKnhZtjS6J0i6m:9LIHmWh6dm
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b00da009ee9c5eec02ce669d1ecac71864378c48a06d3f9f03839bf829567e05
MD5 dc3febac552c67c4707156f98a534ad4
SHA1 b6b3f73b08604e38e389a744d0e4c6d51dc495aa
SHA512 deeed91cee639c546e4aa559e13bd4f3511dcaea8c9f3b25479718e60f66897ec71d8a1fafb553fffafb402c8056cc4556eef37dc393afd7a20879ab1386d4a3
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glOTjfmF6JYTiGDm:eu6JmVxd2dYjS6J0i6m
TLSH
T1BBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d0f9c615df47c229bfb51278b873b8ec4e0baea933c41d202333ef08be7fd133
MD5 c865eefa526599beb9ab3a47f009a3a4
SHA1 801cd7fd20b29dfd55166810b612ff520774629e
SHA512 f238f88209e3a47bfe5d2c210cc7b6be0d9047aa77151033bfc257ff9eca9cb698b459d5b72868d8eed4ee997a03847df731ee4bee045a04dd6f9f58f4b3ebaf
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xSTjfmF6JYTiGDm:jmifPbR3jS6J0i6m
TLSH
T156B5BE13F2D900E8D06ED17887569632EA62BC450B31B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c79bf6adda34383858c6ed215521b8bafc2f79f1421fa4e14230c62e5110ebc7
MD5 53966546472c93d048faabcf394db106
SHA1 fa09913af610961505416a510451d02d75f6afce
SHA512 b3cdc66f6f6b93a6967a6bb60f042af3a77a4b254bdb14914b5b83d574afd96e92c34a2f182839333032049cfa6b6be28b9c5c6725e701c66e8af1fb30bd16ca
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHq9TjfmF6JYTiGDm:T5dKTi61xjS6J0i6m
TLSH
T1A7C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fdda313a7bb8e26b9ece09c875e76b00d5fd3525b504a233a7e3cffe6845c353
MD5 5ccc03816c15efcc3964fbef9b791c7e
SHA1 a5a0a1afc8c58b1c07babe5d4d97ca4bf7806bea
SHA512 8cb2be97f7b6dffebb4e21bf0dd34dd97f1b6b4298d02a73ac29bd46b86e434f378dd2cd8d562c2d0c9d6907439ebb5847530cb5a1278657d26525ccf38476cc
SSDEEP 49152:phtSn8EApI0figngiDn0AP5w+TjfmF6JYTiGDm:YX2iyphTjS6J0i6m
TLSH
T1FE95BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6f75793d5a7cda375d524b32a7538d2ddddae095450f040d6b825cb20974f416
MD5 730eb2ad3fa14269aaf194fed1b34339
SHA1 7c0b571d60d06d113a3eca3b0f589c80800ce87d
SHA512 7d463c2ba55364f7556652c6372d677a0438f3cfaa97fb7c22ba5de33ee2e42c6246e8cc5658ddaf4f2374f3134930e756d6b67e2c217f1eafe083637a7ea98d
SSDEEP 12288:h5FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc5:h5vrjfnmUWpEJcvTiGdtmOyggG
TLSH
T17D452341ECAEE513D35360757952AA451C6C9CE09A63D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8b2773849a268303e0100f153f855219a595fc690d131dd5f0139f533724a234
MD5 df86c1ca657b855814ef304f45db7059
SHA1 83032289a1b3c24b29de84edaff0bcd14c0b45b5
SHA512 a70d6d931ccf149d0c69a472b52c3f5a0eea650dbc15f0a4a0119081b71d0427d3c21edf5bdc8e56a6a629cc2e5cf10da03d78ca69d3a5010a447905e673a096
SSDEEP 12288:doFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcW:dovrjfnmUWpEJcvTiGdtmOyggN
TLSH
T12D452341ECAEE513D35360757952AA451C6C9CE09A63D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 461d9b5876d6b90ab11daf099e7197eec4116eade1e8b11e0ef01b5ac6e48c11
MD5 6ee761396c58da00542d726fec4067c4
SHA1 e9af061499063b3bd56db379f1b1d99a0c2108a5
SHA512 98284a35b11efd0f222a3774456391425f0008932a13991e19a338b3932409af79a89d1e4bb51293cf42a038013df41a82cc1e8e88b437ef2be2e8f318448d88
SSDEEP 12288:b6FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcU:b6vrjfnmUWpEJcvTiGdtmOygg7
TLSH
T1B0452341ECAEE503D35360757952AA455C6C9CE09A63D9D03AE83C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 657e94199a7bc611c3b64c7b704072fbf624c83c525a9924c11abc001f3bcb4b
MD5 0ae413f657db4f567f9c94d8c96f2282
SHA1 46fca96f59c86ab53373044ca7323b6f29662137
SHA512 5120b5412428894653cf9d735d585527909b75adfc4726a2281f6ae40570b9a4d90840252686c5eb92fc84a654efa85b2d149b983c1312e13484acb3601e170b
SSDEEP 12288:+VTFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc+:cvrjfnmUWpEJcvTiGdtmOyggl
TLSH
T1B9452341ADAED082D7639134A95299059979BCE04B33D6DB2B903C1F0D343C85BBEFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 51142afdec0e10595640097424d19068f35a2f11c1e147ee16f770620a7c1a31
MD5 a2e528a958f38dd4c58f56932d464c9e
SHA1 f450af45d7729e2efc4027bc93fd906d15bf9329
SHA512 934d3c798fd9052679639aa1bcd8f03b45b7c627dc1d31a17c1d5a4c73d98ec2d6f8717d66c37f8ddd6529dfa051de5afaa4e6882e1bdfa16190ce38d0c3892c
SSDEEP 12288:mrFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcG:mrvrjfnmUWpEJcvTiGdtmOyggt
TLSH
T1BD452341ECAEE513D35360757952AA451C6C9CE09963D9D03AEC3C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4bd65ec317c07a450d2ec83eb5cfee313470bd962f2248dc9dde44ee1d45f6cc
MD5 8223a73acf85e096110e6e89359a6471
SHA1 011455e378067c207dfe4960dce88eb540a363f4
SHA512 bae53b2164275ccc3b20d3c1e6960930f00539faabe29191f22f8bbdc80eef9d90d4280f0133969decfe2c15e64433ba6ede1960bf8718f84caf249406130c01
SSDEEP 12288:HUFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hce:HUvrjfnmUWpEJcvTiGdtmOyggZ
TLSH
T118452341ECAEE513D35360757952AA451C6C9CE09A63D5D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 585ff8c84b0bc2ddeabd521881d48a15b58c0f3027779efb6ac78923e2aa0afd
MD5 b83487ddd96bc6408afdd6a14b0a25a4
SHA1 f1e8ca9b408887ab64ee42ef0f52a7e4688cc7c2
SHA512 bc0418b5f2e5466eb85cdb46c832223a8e5b87631e900ddfb1c736280bf177c3e99a5ce9a5b506125e2b255b3bf742e7a588206e471d180496a7e1e424ae29c0
SSDEEP 12288:lAFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hch:lAvrjfnmUWpEJcvTiGdtmOyggu
TLSH
T1E2452341ECAAE513D35360757A52AE441C6C9CE09963D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a0f942ee914a2d33b017473f5024874eff6ccd341b6e613601211c174720cdd4
MD5 e1a7ff1e5ad2479579d475b61b852ea8
SHA1 cb60a78c15704c279a2323411cf7b973b0689e35
SHA512 58be267dc52c0807b2251a54e88535236ec14e4ff89c4001eff1073783c016cf73bcebf2b8208837b4fa1fd2ddd81f93b856778dc2f59482dd90f786b0667ff7
SSDEEP 24576:eZMSzFVSOIvrjfnmUWpEJcvTiGdtmOyggf:eZMSzfETjfmF6JYTiGDm
TLSH
T160650195B6A058F5ED63813EC9128906D6B2BC650B70C65F13E8362B5F333901D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b13508287dcda61549b4e08bf55a79524bd279048a379a14db9292ee488cb93a
MD5 1657fa6e21bac320f0a9929ba333387d
SHA1 fd321160348605f4cfb33809362acef71f754335
SHA512 6829ed3375bd9c1d58f97daefddacb22ad3f1f58fb001b9d8e83ba3538665f9445bbaa6c371f7b8986fef42b63a7460d0e036c8c5c4b50072fa475453c0899f0
SSDEEP 12288:ftFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcS:ftvrjfnmUWpEJcvTiGdtmOyggJ
TLSH
T171452341ECAEE513D75360797A52AE451C6C9CE05963D9C03AE83C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 676c34bb7e0bebf189f257188ad2c9f0d8a4949880e0d95c2838414bc2f0b7a6
MD5 8db3955b41d07aaa6d943309bc2b8eac
SHA1 dab248bcea399313f5b653120a2a9f1bd9a05963
SHA512 de398f17c56095f5711075eb29066023162f9849c6c3c10aad0f91a2b26b46810558a0cd6320e97f4d4ae97876f2b6571c2091801d53975613690b3d0a64056a
SSDEEP 12288:zhFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcU:zhvrjfnmUWpEJcvTiGdtmOygg7
TLSH
T10C452341ECAAE513D35360753A52AA451C6C9CE09963D5C03AE83D2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 fa35d3d0042f7636f809292d4141e698bc13a430325e21f9e15767a35d121b59
MD5 6fbfdf38c42d67998f4035333db1d5fa
SHA1 6209ca75777a3e66a8ed22265fc7e419e5101918
SHA512 03299ac8dd73d76ad5294183e3ed293229db36eed61619f63d91cad5effecb463aebc75ee255934b1ef84d2b6f4811f23d0f3de7dfae40c7d5f8bd7f59552fa3
SSDEEP 12288:fyPz5L8cFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcM:SzycvrjfnmUWpEJcvTiGdtmOyggX
TLSH
T1EA5502077AA530F9D277913888521A01F775B8710B21CAEF17A41A7E2E372D09E7FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4c9f451f2262b98d3fb123d17486e5e36032865284c34d82f1982bffd3ae0ac4
MD5 4f314fca676ae6facc2e46df14b7ee81
SHA1 c6cb63c2d8878974f5473f910344019bb781edf8
SHA512 3cd929cdbfb687f2e2d60b03c576e0861910ccf32535e86ea4fd8ec0a8657aa96ff88dc996f628b5d96ffa3add6ce8311f76a3221bfda32a6e4900d475bab2f5
SSDEEP 12288:utFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcw:utvrjfnmUWpEJcvTiGdtmOyggr
TLSH
T18C452341ECAEE513D75360797A52AE451C6C9CE05963D9C03AE83C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e7218d8280adf8065fc81986fb22eab9aacd0800f24b28de2e5d23e9e8a87b00
MD5 fe4731466660d868dedf00bcf0b406d9
SHA1 4c7564fa7aca2137615007dbc8ad767de760d509
SHA512 5262689ba31879c28d4beaa5767c1b64a53d1018c32a3a27661fbb78f879bf46b373a7fc2ad2d1ff6df60a68094e3a7b06cf0a7e49badbd1461a1cd79775e15b
SSDEEP 12288:gtFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcl:gtvrjfnmUWpEJcvTiGdtmOyggq
TLSH
T16F452341ECAEE513D75360797A52AE451C6C9CE05963D9C03AE83C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 abe6afc4acb80ca95f642a721dcb148f906c1783a3260a7fb44884981d999959
MD5 fc72f7953d76b3f4116fa787198007d7
SHA1 5bfecba9519e4daa3c671270b8c849834bdb96f2
SHA512 990876568b0fd3f0794b1c6a71f26ce817b9e4de256a45dd14acf72c6ece0ba7716518419d7079fcfcb5e339a65d8649af718fd852febb280c0ade75fda44bbd
SSDEEP 12288:NyPz5L8cFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc/:kzycvrjfnmUWpEJcvTiGdtmOyggU
TLSH
T1415502077AA530F9D277913888521A01F775B8710B21CAEF17A41A7E2E362D09E7FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 dd5017369593eb22e764caaa24afb28634c9d219a74ee1086de345507927fc65
MD5 b0eea62cf8f8c8912d60a09a55c1f2d4
SHA1 10c1b44da37e74f67208e20fc62821fe5193b045
SHA512 abdb8e9400730e162e6704ca552858e5545559257bddcd7a787c09838ea7a3b025c3a50d146c5e662cf954cc69f146909a5e89390a76e410d6f2f99259ec1914
SSDEEP 24576:lTHaLl3z0zDKvrjfnmUWpEJcvTiGdtmOygg5:lT6LljfTjfmF6JYTiGDm
TLSH
T18A650194B7A058F8ED67813EC9128906D6B27C650B70C65F13E8366B5F333901D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 32ab237799130cbdfa9ce4b671ca413ccb7c7b558259078caeddbfbed22eb193
MD5 d344b396da3897660d1b775681ab7228
SHA1 e0082362e1344835613ffe41524628436ed848ad
SHA512 c492367176bbef8c94ca6e84f6d467c694dded3161fdee6e7b1c6405550d98e15049c03a61d2e600fe7735b51bfdbe2e5fefa74b08c2a44bf62d0ef3e2c8c6ff
SSDEEP 24576:UcP4mcvIjkGOxhKP2l71nNKbrh/8KBFvrjfnmUWpEJcvTiGdtmOyggn:vP4m4IpOO67W8KPTjfmF6JYTiGDm
TLSH
T1E565BE2DABDC0096D0BB913885658A4AFAB1742A1F3286CB1160933D3F77EE54F35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 360c979de5f1700819bbf2788e565b3ad606b3a1260b8779a4be656a101f3519
MD5 015d12ee99bd7797132b30d777dc7cbe
SHA1 b4f320b22fbb2f6d7ae09c629ba0307846f8a61d
SHA512 4004328755f2f8c1fe108f4ffb132c1ecc7c51701e61a546e79de05b81c616095204f75eaf79b221239da92ca60580a0376fa86f8b85bd60c69a61a52452abaa
SSDEEP 12288:ENsf9FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcK:V9vrjfnmUWpEJcvTiGdtmOyggp
TLSH
T1AD550109D69852E9C16E6139CB524A41B7377C6087E2D3CB26D0F93E1F392C45EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b2458cfbabf1d27dc7f506e4e3896ea18b69f546cd3a141cf06b2d4609efa110
MD5 0a22f6ee162faf4c2d08ae6546dc2fd4
SHA1 f334b0bfbf6907a0a49da39e61178eb09c7c8ee9
SHA512 65100d272f12d308fe2277972398a80b16ea42e128ba967a3a5c65bd00a5160d4ec82d56e321de232a0da31764755fcf0840f7e66c03a03993e1638e971223d5
SSDEEP 12288:ndFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc5:ndvrjfnmUWpEJcvTiGdtmOygg2
TLSH
T146452301DDADE503E3B7613439529914292DBCB04E62D9C37998396E54386C48FEEE8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 bc820264ab22c28b30b45e9d40e905a3a8c24a11cb09471b087009e7c1e1a9da
MD5 906fb79653d415adc8d85f07c62d9da7
SHA1 b1dbe90aa86d85772de0e376dcdb5ba0b6d83211
SHA512 636e6c7105f594691d59e92d9aa0b4460136c35b346aa5d7e344f2d9648325f262f4efb4f9a56c3c8a8e24ae817b04521acf2aa167bf7306c1d1b8201663c5f1
SSDEEP 49152:Ga0h2GEkuAe73q3pp46zwwQrTjfmF6JYTiGDm:Ga0hNYG4JwGjS6J0i6m
TLSH
T13E85AF1E67EC82B5D1BAD278C9A6854BE6B2B4220B3156CF1150853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 a695ca21dc4694d65b71c6b2e1eb910d7438302578d3d1b6b7e41b685af8e9a8
MD5 0953de9ca56453050b270785be0bc68b
SHA1 0bb5713ebec7306b796f943a5d2d0dceb3f2eccb
SHA512 2c82348b94801998d317f3b6d72296538d0679f59362945589c215c92ccbe9db99875f72e90d2e6db02cc0e64545a6468a0c120281b8dbd1baf160cadce38519
SSDEEP 24576:M1QT7EcpfxR+N5AWAz3ooiYtjMqb/vrjfnmUWpEJcvTiGdtmOygg9:RTDxR+N5YzTfjMyTjfmF6JYTiGDm
TLSH
T1DE55B02EA7F855E9D1BEC5799A23C502FA727821033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 1e5fee1df7a67750d235792a48e73427d21dc62c903ac20186cafe25329c42a6
MD5 8cb941566f6b3da808da8a8fcdbaab63
SHA1 91dd4c261e70fff2c236bcc34a01ca3dce25fdcf
SHA512 fe155906f34e61a226f7a15e38a63d3856067f5844a62b002db74f04d52284acea142a609e14cdd5078fcfe5b19d897480d8c1f2b43e2b26defb7d0c325426da
SSDEEP 12288:7hbHjfX4FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hch:7hbHjP4vrjfnmUWpEJcvTiGdtmOyggS
TLSH
T1C955127E1AAC2095E272A17D55528906D731BC600722D3EF23D0927E4F3BED84D7AF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b308c3ba1c02ecb2b1e2ab8b13908b7dbad7115b1d225cb75f075b56b0cf6423
MD5 19d065b12d1e302ccaf957bfbf1666b6
SHA1 80c4141d49b977b89cf1a753a24ecbac3ba8b96b
SHA512 0a8502c56c530ac6185a5ca30e63acbabe82344d5c807567e15185e396ce8005a5183d3bcc7a024f2e65d20257ac8751ee84dc69e1170c6547bef0a8a34d942c
SSDEEP 24576:M3YgnJcRTk4yti+R5dBR/wvrjfnmUWpEJcvTiGdtmOyggm:MIgnaTk46pBR/wTjfmF6JYTiGDm
TLSH
T17945BF2EF2B910B9D8A6D136450147B5BB71782D1F209ACB0170C538AF1AEE85F39F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 aebd81686648a459abe903fb0d42f279188f4544c87af5bb53d6170162990ca5
MD5 76b2a936dc14157437e5d0f46cb50dd5
SHA1 930fc541e7846f292648c19cc595f6673c2619b4
SHA512 67f2685d853069352e3db574dbe4aa0dc0cad9341314cb50b44776c8817c38e29452c37f2919be6fd86b00b560a3c57d342ae8941a8388a75798647a22f52f0e
SSDEEP 12288:MRFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcE:MRvrjfnmUWpEJcvTiGdtmOyggH
TLSH
T121452341DC6EE503D763607939529A151828ACA04B23D9D339E83D6F95386C847FEECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 648e8fada2523ea8bd5cf121bc1342d87dbeecf00abb271c4fec5e27feea66b6
MD5 9d13fb8a428863987adc1943cd6343af
SHA1 9b4f7d3e7ec608d1fce20905f7d29082addb76dd
SHA512 46c676bee77492e10e19e40ac8df1b6b2df1ec9c101ba973b49da022817b2694e2bac52fa9edc141a0352b63065e7474354969f9e72d2200432e77ee532edcdd
SSDEEP 12288:/Ob9A4LWOsvAYFT+FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1H:ApL3UT+vrjfnmUWpEJcvTiGdtmOyggH
TLSH
T11E750145FAA440F5E977913CC9628A16D672B89C0760E7DF03A84E6A1F233E14F3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 d9eaa596b6f7325b4ccfb4326cae33367423fd502fc795fec1992f419001c85a
MD5 69530a32ff5f1288292c844c547153a5
SHA1 eca9503583146e6225c5bedc7c2d8e17d80ae8e1
SHA512 6073dd9f7672f76f012ea4565307840632b0a88174c1f7f65d3f9c8f2b212d390cbd054ff1082239bf5d5eecaf050dbfb7a065cad6eeadcf25e282e0b52c3de4
SSDEEP 12288:gpFtpOSFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcM:iOSvrjfnmUWpEJcvTiGdtmOyggb
TLSH
T1C15512193AED20E1D276A13C99838609D771B8A0072297DF02D0817E5F77BE85D7EF92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 90eb38243131155d43dff7908be48a449061b15061d178328f7daf85935de42b
MD5 269795b92af8613f9f3787a1c3d7f465
SHA1 895dcfec18c77ff6aeaeb9436e262e1ab6540862
SHA512 3338ef84cfb301392aff0e06733ccedeb231268d2b7eabad451a463a997f47e18e588bfb6ede5b9269c3949353ec235957c51299e29735c9697790950e5040f3
SSDEEP 24576:J7NM9YqZqmWMUkPjZM48Mv6bEhstvrjfnmUWpEJcvTiGdtmOyggX:J7cBWMpPjN8DbEhYTjfmF6JYTiGDm
TLSH
T1D665AE2E6BEC81D5D577D13DC9A28205F6B1B4611B318ACB1162833E7F37AE44E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 a73871dd07fb178ecd55bfd315530604183387a987bedec347a1e248ea83956e
MD5 10bf678bcc3d690023b8a500a81692db
SHA1 b2763d29b9aa89e36e70fcc97700533bdf932a57
SHA512 5f5a8d72772e0a277369f8da3a83e23315643978f5fd5313d553456727ca9a56de5d96fa5a9771ed4f9dc8f4590d962be58343c8f7edbf9247dab68bc3e732e3
SSDEEP 49152:eF2YuHNETovAvNYf8kmNTjfmF6JYTiGDm:P6BCf8kUjS6J0i6m
TLSH
T108857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e5fdff42c933cd943a3cb09877bce01b08514310b9b369bc962c1e848d39fdd4
MD5 555debbc95af2493855d0cb275c507a3
SHA1 49217fe799d8b0b82deac18b8a7f62c48da041f1
SHA512 151a6ee3a7861eab2df7b8969a8ab73a41f09378fe62b431b4ffaed5a21d09d19863aac6a4a842544f33c6423e4053f25b714fa0f7b8628899df737bb4b5190d
SSDEEP 24576:mAFs06+Omlf3NXEbToGvrjfnmUWpEJcvTiGdtmOyggi:PFs060lVXuLTjfmF6JYTiGDm
TLSH
T1AC65BF2F66EC00D5D07ED17D8A97C91AF6B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3b86a9b3163efd5767da32fdbe81f7c5b10e63dd79276a91e965bb0f6cd8cc00
MD5 caad0ac9c1af771d0a16a70be666e565
SHA1 71663c2804e72a4798a990024e4576c9dc14926e
SHA512 e0d59d22a3492b9d177bade27bbff3cafc6c8e86ef5b7d3e735bcc1e2c0372719801509a3bcd5fed20bd3f02e2230789d72379b8a160da44d660e9902d019b4c
SSDEEP 24576:oJnJ5D3WXLvrjfnmUWpEJcvTiGdtmOyggC:oJnJ5DGXLTjfmF6JYTiGDm
TLSH
T1C675D02DD2A810E4D4B7C274815A1B55FE72387D2F2269C728B4D5393F22FE09A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 73b55ead01156d488378309bd6f6787b942e8a14057d28ff0c978ef05554641c
MD5 fca0859d0451ce1545d3e7a52dfc87a5
SHA1 9845eec11b43dacdeb710d3c495d6ee82edfe14f
SHA512 5207122b1275b9408b2fad3da295157fc9b56fb37d88ac1e9689a240682d61eebd13787ccc86de562fb1c5e115162142380df82d5752a8aeb21b6814aaa9386f
SSDEEP 49152:Gg06DIKdwc+eQnSt65aV5TjfmF6JYTiGDm:fDjS6J0i6m
TLSH
T1AE956C05BBEA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 0befcedf6cb867f5aeebeda4b87d29ab147c787cb34db8bbcbd95118e1923686
MD5 4af450ea2d0ee203cab54d82796964ce
SHA1 0071b586c9ced4645b8a6d398b7e8af35e3c260a
SHA512 942e9d3bcfb9a98617e16088c1a38236858275e85bf8ab692b4a94231063e4aee51d06cd60e268fc5c64fd9c6324a4c61a8fd26591d158d75b45dbd944bec4bc
SSDEEP 12288:SEP3Rn/FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hci:Rn/vrjfnmUWpEJcvTiGdtmOyggZ
TLSH
T1B155125D6EADB0A6D227A03D95918604D372F4B01B13A7EF16E0913E4E37AD81E3DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 594fd0367d2dc700ee902d152801fe5365ff3f13f92f1c227f5d6040b44d4fd4
MD5 6837421147f3d7618664eca12b980614
SHA1 7dd7aa8e399d715ed80612872de0a766cdc039dc
SHA512 6547df60efaef2f939a441ef89d7f076b4dadaf70f0aa305e5ee446011451c5aaad7a3b66edb9f7d393f23caefec615cf71c397f422a081378bb853546dc18f7
SSDEEP 12288:4jkyoFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcW:4IyovrjfnmUWpEJcvTiGdtmOyggF
TLSH
T1BF551204ABA8A041D7B61138A96386905E38BC705F22D7DF21D0FA3F6E357C49E79F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 987f7907c99cfc306e89c804f6689220ca311062fbb2b55aaac1b94d330c9a0d
MD5 90e5098712acea2558c7e12f123c28f8
SHA1 c07883f95314d8b962ed4a2c191a9c7c0bd242d4
SHA512 10398bc8aba41b9528fbc646a5821161b5295dca47685289274cb6a678385152ab678302e9313680effe77d8b7503bec1eb59b2b635e16a1592c985a2e387013
SSDEEP 12288:ZyCFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc1:ICvrjfnmUWpEJcvTiGdtmOygge
TLSH
T1E6452344AC7AF512D763507929129E4419387CB00B23E9E725E4B93E96382C857FFECA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0376163b36579006e01194a848ae30df426ed970bc97fb64e6a76489c87c23f7
MD5 026915d796b01598d01879d6c0956d28
SHA1 9b0f64d094b833453fa7e191ef3681c22e42679b
SHA512 6f196a691fcbc27927c8f68c12bb87acf2c600db4ea1a41d8202aabe13bc7cbdd649614c27fe3d35ee8f46368ff056f50b246aadd018d0e8e948d15c15832b0a
SSDEEP 24576:aQ9MxZKdcz9dw3VvrjfnmUWpEJcvTiGdtmOygg/:aVKZVTjfmF6JYTiGDm
TLSH
T116558D2DABF9059AE177D27595A250C3A633B4301B31D6CF2448D03D4D7AEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 36b9aa4c7b297465653c4324a30d8a7d0b7423ff06d0c3bb4187fe2ad66643d6
MD5 4fb11ef44774d39633e2cf837e56182c
SHA1 8f260df830fb6abd7b079cf439ec4611eca8018b
SHA512 7862efa3fbabe4dddefd2742efec32393eb8e52769275e7982500c826a35ffbcd0e2166d3a3a55eaa0207302220451d5c0eac9467ac605819bbb42b381a2a1fd
SSDEEP 24576:ryocDApsvrjfnmUWpEJcvTiGdtmOyggo:eocDApsTjfmF6JYTiGDm
TLSH
T18B65E11FBB6D40A2D172813C89818745E773B4701B6297CB6591C73E8E37AE8BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7ce8073858020fc1bece0ab95b472e293979c584b7ecabd963fbecb960ae25da
MD5 b4c5e51e59257db9722591f516d68213
SHA1 9420e024c30d875b9503c3cb5b1dc810ec7f422f
SHA512 fdd531190153d3440f2ba618f2c0151a2f6d051ca3879e1f5d84ed6efa432910d95e57e76102531c73e44c79359d62d2a0b8f433355cf67a359373a6f7afe51a
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKsTjfmF6JYTiGDm:k0zuNIIjS6J0i6m
TLSH
T192A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 e12f82e881352351d7b663fc9974f998a01d551002114616ff4256fcf23b16fb
MD5 e56280fc90bc4c6640ddf2012b089b39
SHA1 e52b2cbeae1b8c39764a10589a3248db2a817436
SHA512 8f368297a14c1bd4d2b4c1207f80568c3aae108791164db6f3e537ce36447745f6ecee776a51b8d43b88cabff2fba0d5788c729a2a3a8e3d573aead55685ca10
SSDEEP 24576:NTMdOz0FFS+imSLTvrjfnmUWpEJcvTiGdtmOyggq:30K+imSLTTjfmF6JYTiGDm
TLSH
T1F375E13EA76D14E5E57BC17C9A438906EA7234610322A6DB06D0C17D2F6BED43A7EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 0a060c4c28a0abdcb438ec20715b2a78deb9748b4152ec1ac8768ae1de5807ee
MD5 8790c40010422155023df09dc4adb7c7
SHA1 70cb7c768d0dc00202bfee7e60cccdd6b00ab118
SHA512 b4150b4f67d206946583f04f7c0c02c65fbf8feade6145b6f9fbef3afa162906868bbf7406898a4f99771eb38abd1a2974c6c7b4af7b9c2f26c66e7ecffaa77d
SSDEEP 12288:r4K+FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcv:3+vrjfnmUWpEJcvTiGdtmOyggY
TLSH
T12755120D6AEC7091E67361389A2346054A34BC7017229AFF35E4E97F4F356C88A7DF46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-287-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/820-60-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/820-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/848-416-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/848-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1004-285-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1084-289-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1640-281-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1640-118-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1640-124-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/1672-284-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1908-283-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/1928-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1928-290-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1928-51-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2084-74-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2084-62-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2084-68-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2084-71-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2964-79-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2964-275-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2964-85-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3080-286-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3508-142-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3608-102-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3608-277-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3608-107-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3964-95-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3964-89-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3964-276-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4008-282-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4008-135-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4008-129-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/4344-449-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-443-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-452-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-430-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-455-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-454-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-458-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-446-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-431-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-453-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-451-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-450-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-447-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-457-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-456-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-448-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-444-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-441-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-442-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-445-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-440-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-439-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-438-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-422-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-423-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-424-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-426-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-427-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-425-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-428-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-429-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-433-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-434-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-435-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-437-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-436-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4344-432-0x00000204A2480000-0x00000204A2490000-memory.dmp

Download

memory/4388-278-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4504-34-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4504-24-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4504-33-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4512-157-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4512-193-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4512-471-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-288-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4512-420-0x000000000CDF0000-0x000000000CDF8000-memory.dmp

Download

memory/4512-173-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4636-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4740-266-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4740-47-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4740-470-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4740-41-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4864-32-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/4952-270-0x0000000003800000-0x0000000003867000-memory.dmp

Download

memory/4952-9-0x0000000002F00000-0x0000000002F85000-memory.dmp

Download

memory/4952-8-0x0000000002C70000-0x0000000002D7D000-memory.dmp

Download

memory/4952-291-0x0000000003800000-0x0000000003867000-memory.dmp

Download

memory/4952-15-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/4952-1-0x0000000002550000-0x00000000025B7000-memory.dmp

Download

memory/4952-333-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/4952-17-0x0000000002F00000-0x0000000002F85000-memory.dmp

Download