Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe
- Size 1.6MB
- Sample261030-ejc5raws9q
- SHA256 521a7e8c5651b0d9842dd2a4a6f7e2c7fcc41d9b46ba2bb4251e4b05de3cd111
- MD5 59e0bd046936b35fe064a92a250ea592
- SHA1 bd1a6b54b23ff123adf4b2cbf4169f6c7b8c2c80
- SHA512 6ecca7658e5e41d501cf583f863ce75a2cceec7e1588e9de276411eb5dd5ce1ab55261af64916674796ef4a4d5f09850e6627a2f179d9baf21b687e1e1def858
- SSDEEP 24576:5TyHghrtNWDF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EghRYLNiXicJFFRGNzj3
- TLSH T1AE85E0207581D032E47200358FB9CB76A52DBE240B2545DBE3DC3E6E6E78BD25B35B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
pid Process 4568 alg.exe 3468 elevation_service.exe 3592 elevation_service.exe 3304 maintenanceservice.exe 3936 OSE.EXE 3116 fxssvc.exe 4680 msdtc.exe 3428 PerceptionSimulationService.exe 1616 perfhost.exe 2264 locator.exe 1248 SensorDataService.exe 2068 snmptrap.exe 2008 spectrum.exe 2120 ssh-agent.exe 4184 TieringEngineService.exe 4300 AgentService.exe 1444 vds.exe 2448 vssvc.exe 2712 wbengine.exe 4968 WmiApSrv.exe 224 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe alg.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\fxssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\2ef72d19250d612b.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\spectrum.exe elevation_service.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\system32\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe alg.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 SearchIndexer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain snmptrap.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WmiApSrv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain alg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname snmptrap.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dda0820d2368dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000828e8e0d2368dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062e0200d2368dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f7e3d0d2368dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003ecce0d2368dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ce3e20c2368dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af1fde0c2368dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe - Modifies registry class 52 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A} 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1} 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40} 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe\"" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577} 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}" 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3468 elevation_service.exe 3468 elevation_service.exe 3468 elevation_service.exe 3468 elevation_service.exe 3468 elevation_service.exe 3468 elevation_service.exe 3468 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1920 2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe Token: SeDebugPrivilege 4568 alg.exe Token: SeDebugPrivilege 4568 alg.exe Token: SeDebugPrivilege 4568 alg.exe Token: SeTakeOwnershipPrivilege 3468 elevation_service.exe Token: SeAuditPrivilege 3116 fxssvc.exe Token: SeRestorePrivilege 4184 TieringEngineService.exe Token: SeManageVolumePrivilege 4184 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 4300 AgentService.exe Token: SeBackupPrivilege 2448 vssvc.exe Token: SeRestorePrivilege 2448 vssvc.exe Token: SeAuditPrivilege 2448 vssvc.exe Token: SeBackupPrivilege 2712 wbengine.exe Token: SeRestorePrivilege 2712 wbengine.exe Token: SeSecurityPrivilege 2712 wbengine.exe Token: 33 224 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 224 SearchIndexer.exe Token: SeDebugPrivilege 3468 elevation_service.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 224 wrote to memory of 2128 224 SearchIndexer.exe 119 PID 224 wrote to memory of 4912 224 SearchIndexer.exe 120 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_59e0bd046936b35fe064a92a250ea592_elex_hawkeye_luca-stealer_lynx_mespinoza_njrat.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4568
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3592
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3304
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:3956
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4680
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3428
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2264
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1248
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2068
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2008
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3044
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:1444
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4968
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2128
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
- Modifies data under HKEY_USERS
PID:4912
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 379b10de84acf44ffdaabdf67c16645068d7a06b8b4f2cad057304dccba54fad
- MD5 e4e3f2a045bca5ab36a9615fb07c5d72
- SHA1 df8f4ad187247cf914621e39df4fb485108db1f2
- SHA512 0aa8fa31a1357e63a4fb7d5d75ae419bd50d3e54425ab448055040aee58c11f59b808eca80f3f0a35351cbd8feaec57e6a73c091442a98bb6d7c957033f375bf
- SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/LNiXicJFFRGNzj3:v3q6sjBU7wRGpj3
- TLSH T12CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 a116c4b1db7119f873900ba0b429abf721ad417bc2f97ef6c1ac4ed37ab7f3c0
- MD5 4eddc9b46e33f86efe40e3aaa6b768ee
- SHA1 8b17c141437d4d3847fc269cd7b29ab3d9bde679
- SHA512 155ec78131df90021eeba2c8cd3ef2eb1f89917ee8acff09316fbad6f54646dbda1362ed98cd9fc25118b2f2fc1f2fca857521f0589816185ade46b9de88199f
- SSDEEP 24576:BXYfDtczAI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EtclLNiXicJFFRGNzj3
- TLSH T1F675012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 3263ee3271c50981923694bc28411ab13b8d1407e88215eb50e1c4314d9e9f31
- MD5 3b55af5c2c3d1fd53040db4492454e93
- SHA1 548269ab563e21eb65794d93330bd1902ec2e680
- SHA512 ad569cd63b83e4010c3ec9e91a0748a437edeac53e2e2f906a2819cd4acb1fecf00d0e4f2e6512459821715b07113451108cac6fc8f2a5f83c12e60937aa058c
- SSDEEP 24576:50Le5ji0hmxxrMn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5Pji0AjqLNiXicJFFRGNzj3
- TLSH T1E295AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 4c34e9585758ec8adab44a9def0ace06f68bdc1c4595749509036fab6549fc70
- MD5 fae705cb972dd62a2437999e414971ee
- SHA1 33e254d1e5cce5012bf961a031b5ce120498f07d
- SHA512 4368587a5c1c8fab007248010fa6070dfeae1a7d36ab9f17e3fad355cce52860f944d425426510cc1f65ce0cb980ed4b080fd7cac25d7aff3128098828337644
- SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyu1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5/ezSC6vUzPveHjy+LNiXicJFFRGNzj3
- TLSH T189756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 b8876d0edf0c610f90df949a7b9cbe0e4f4e0e15180ca6dee56110a416b72d10
- MD5 c7a99bf8e378720055d49c1d8fd9ead2
- SHA1 bb4b0dbc83cb7b82db5429c5fd04e8c189976265
- SHA512 a1e440a1f0fbeef97df0fda37c8dbfe95d3a3cbc215d138ef3b8e9319c68053f91d02a0efab27c75a9f3c71a52e9333cdec8cdc04e7c3fa68460bc90906e74fe
- SSDEEP 24576:5VbqPb88hv/l+Yk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5VO88hXl+NLNiXicJFFRGNzj3
- TLSH T12F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 4ba55f6294915d23a1f253eba7e12c3357ae868c4f3efba2567df2e7ff60206d
- MD5 2ada092b019e33a1b76abbc2b4b985d5
- SHA1 96a47b88aefa3279b8716c846d9948214fcb00e6
- SHA512 eb3d3af6e5f9c9340c7ac0b3a9f20c0343c2c53ea32a015a5711d2c355918b37250fcf7b38b5e6e367cdff21e5fa360f4679e62ef2d7a9bbf9a7581b4bf4a47e
- SSDEEP 24576:4Lj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
- TLSH T18B5523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2503E5EA17CFEBCF39123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 4b00862264d70edeee3f1590613dbed1f4abd5c960313248cb22a32924329b74
- MD5 ac206c120e8f2ce0b601ff7dec907431
- SHA1 51257e14ca0edc25d7fc5c768187a604e0be1bab
- SHA512 d0b59217df197be36beef68e9385b30a643ad5978ee11714715a1d28bdb7f46524e8baab83d7e1ad75afc1abb0bd3666eb3dffc23ec539ef12ecb86e338773f3
- SSDEEP 24576:aJIUs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJIUsLNiXicJFFRGNzj3
- TLSH T1F175CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 53decaf33e29f9542f8d918ec68a6ae26729a6feceb9d2dc417216b19019c14d
- MD5 d7ef5e404331db90425882b0bc1b1337
- SHA1 801056ec8a688826e351289a6af216e9f5379613
- SHA512 c3e0a182428c86f64628de785668dfe738fa0ec196f68eb36226950ce935ad7853964c67aa520febb1219035a181f22fcd7e522b13f276eca1096083e8befa3e
- SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:jQvGAdlCEL8c/DRNw5CF7wRGpj3
- TLSH T178266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 0cf825e407c23f4a21780cb1b232326c678fed1ec1aaf50a0a103975a495fae9
- MD5 79eb6884fdfc7440b949832ec32e4cbd
- SHA1 0f9fc729f89045de1d42b51e8b606ec1d677fc0d
- SHA512 dcccc26598c67423e6ad5b0f5bdc93102a57d919cd89bc419ca0c6c675bb912f5bcf017de8798cf2b2691b2377f55098d83e71874e96f95caf929e706d4f71c6
- SSDEEP 24576:50ewsAj6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ilj6LNiXicJFFRGNzj3
- TLSH T1BB75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 8476261b2bee8972279a1648494f9ca0733e84b6a7d4c732a0754012a4cc7ce4
- MD5 2f54412cc0adcc28d56985cf13933ca3
- SHA1 84d5b00e30148aa66b25ad19bbd639d9dbb128ff
- SHA512 d5388ff929a3e90a2701e3222c50838e8048e1cc0095ab29ab93ab9c189daf63d54ea4c2a1c7243db32592032abb04cee75cfa7b572998d6f016170e38d221c5
- SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWF9:RUEtQevvqc2W1cpV2tI32a9
- TLSH T18F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 117a4c4e2e98e88214acae86e5b37b808fd0a287eb6a0ea8fcf8980f1ceb44af
- MD5 9d125f0813587db8e735d42feb52ccea
- SHA1 2a832d77e430dda31c2092f44acf190a677ef51d
- SHA512 4feea1bdc22f8f172952c4a08d90f227153feb45053dff92194ababda4f86615b01bd59641ad7d48a8f47df19fb97bc15aef7400f432921228744ae2e2a8e2f9
- SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/zaLNiXicJFFRGNzj3:MoqHVjnmJ7wRGpj3
- TLSH T110D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a0afe40650d4161e56ee11b2b4b516de975e59ea23a580468e14cfb775541463
- MD5 06218dee9c5595f667a032c0f6c88886
- SHA1 42b3b449775dd9ff15ca6b6bb55f1ff3dc6eb40e
- SHA512 2deb7295b8186f211d95c38ba321dc1375100545030858a9cb678a8f6c4320b77e8225fc39b0616e7750796712e4f70460c6087a0560cc19207346b0d8c94431
- SSDEEP 24576:yAhGL3IFoiwtA5l7S53p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAMUFoiq5ZLNiXicJFFRGNzj3
- TLSH T128359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 21eaf92c985bf9161c91dd92f1c286d54cbbc2ae50789f8fd9276c9aab546b94
- MD5 642cd4a422c9395aa298906a37e3a78d
- SHA1 ad9598d1264ad8024a432cfa2462ae2b8338c4ac
- SHA512 50a885eb49bad82e8361b373cc015b301914c000111755bf8af7f788d04944d4c4973bb47bc4495d71266465714c079c6fa298173837f02deb3fbb53f616b2e7
- SSDEEP 24576:Jwu4OWe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JwvO9LNiXicJFFRGNzj3
- TLSH T15F75F18632940CF9E9BA41398657C036F7F2BC152A25DB5F4360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 6bae2c6c5ccb4f0c35aba430648e68275b0f456cc8c124a3c67c2d520aed14c8
- MD5 45cc033a4d88b2c0c7e109b5d6601236
- SHA1 620c3c2f260308a144f4824bd267c703abfcd4ce
- SHA512 a2b7a35d3fb9650682ba818a769d1c34366d9a35d4c86c3fdec1ea19d1d30df727c68ff565d0ab3105958a5b0ba0ec5b22803e2fc1aba9779e3499394f1a74f1
- SSDEEP 24576:EZuP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZLNiXicJFFRGNzj3
- TLSH T10C65129622D420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD68E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 057ad1aa5b8c3dacbdc0f18a7f1848d5638820470cfddf801840fb62ee09047e
- MD5 19ec6de6deec942a95ee5c49dfc02632
- SHA1 24867ec13cc14d15117cd4439af0167d6d64b67d
- SHA512 e87367e9eb774bb91632145292abbdfb6cf9fff99d48244627826a1363f7b2cc95f6a39ca27a2d0d7ccd4d401329c7d434e1b3693ba58aafed9b5d8e6ad66153
- SSDEEP 98304:0QRQyi36YOcPbLvw2gAf+PN3Q7wRGpj3:bQyiKa/X+PNcF9
- TLSH T1BC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 c229682cff7ba7cc94d4a3a8ade5f07d0cbeb53d1b99238bd38ba9c714e28084
- MD5 6141e9f53ce6b5a35410ef6408b56a29
- SHA1 281d0c8100fc8d26bc306d26ef68c50dd7b1ad88
- SHA512 5fb0a2f6fd9ef77b3f6dd47c713438f2cc3e815ead2a9306c65ae49c1b69050431f10bdbabf773427690b770c659de56a4a9585861b0c6b2dfcadab4de0a615c
- SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3Q7wRGpj3:TQyiKa/X+PNcF9
- TLSH T187667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4eed76b7ead573ff9f70e5a546681b445bc013de9342c7a74c8c920b2b898786
- MD5 94793da0dd9a8885b4df6225cf11e544
- SHA1 b6294ed00294f3bd7bd6b62c56628def8af00740
- SHA512 a247af6b778b63d5b59f3b812bab3e287cc1a22e485810ba22744477f6d9a74aca8660dc13b1690893ed0154ed0130bbcc8ca756da46f1a5d4b787be15470e40
- SSDEEP 49152:v68Qg55nhceWu7PNU3/qLNiXicJFFRGNzj3:pthLRc/q7wRGpj3
- TLSH T174B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 a821f52a5de65fbb131421461cf8c70f5b92f1f80efd4a371e64d3b8f217f0c7
- MD5 1abd0870b9fb67b5a49c3345709e00fd
- SHA1 b0e4fc4eb6d63edae830db5222165d317fccbe7d
- SHA512 5874f0e4d77648a487ce2d48647dae728d647327413b7534b9f7e599ee4c7402bcfae1a00fd0da66c9a3135173963fc25cfbe642432af5686372dac1fed5079f
- SSDEEP 98304:wy5112gYy5azzVvt69nLKnhZj7wRGpj3:JLIHEWhlF9
- TLSH T142167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 1dafbe9dc3fcd173024c2f3c819edd0a34810923d8e1359e82943999d31ab1c6
- MD5 65b5d955763bfd8106d5f4d84cc7cd98
- SHA1 ed2cc8694624d721b554fd38dc60d3b9ebb01add
- SHA512 2f591b9ae132d643368e2856ff8bbfeb550957b426ad57a4fabf425aaea4b16f6e93eb2fe6875c558521fe10cd63a99a3bf83a09a41372d0cfb2a94ad3e0f610
- SSDEEP 49152:+B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4LNiXicJFFRGNzj3:su6Jmdxd2d47wRGpj3
- TLSH T1C5D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 73f44a3b8543ab3784ada9ccef4c2813304170b745e49972470af20a7d74fea6
- MD5 e2eb927a6dfab4986f206db9e6d36e43
- SHA1 9f12d1a3fb3ca8542be0c2140d1b1c819fedc530
- SHA512 1d0869b3377887eeb4ad54b1f17852768150651c1e3e43da205ef2f3c2663a32292a50432cdb1857305df5a388db61fa75062ed76dea0a607148f56d1d63e732
- SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xMLNiXicJFFRGNzj3:6mifPWRJ7wRGpj3
- TLSH T1AEB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 e009617a0234a3b5afb340a75d829e5f1663908baab114f1d6389604550021e8
- MD5 cd90029fc6e2e60e775e4dfa1004e431
- SHA1 0d8fe869bbf6fb3d326b93554419b1a8f082b6a3
- SHA512 553c4c37bf49e4defe40f9222447a9559e620db029ad1abec4ce85fd23de1897871c08330f2132d89484a5155ab6d9308f8c4156a9f416f874dcf03672a29d0b
- SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqPLNiXicJFFRGNzj3:k5dKii61P7wRGpj3
- TLSH T1D1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 8c701e7014d08a977687499f28588d97787bdbeae7aecb36fb3449db45444032
- MD5 a67c5d7dbbe72a19409740d66f120faf
- SHA1 685947af5668e056b9eff7bb882fb768b1e89c39
- SHA512 910525a3c3169bdc13f1dc228389b913de0012d5433c17085fab4c5da410cb20eafbdaca4588a1247a1dff86d940dd77808c5b6e85c34993d4b6cb4fe61fb3dc
- SSDEEP 49152:8htSn8EApI0fig3giDn0AP5wILNiXicJFFRGNzj3:9X2imphd7wRGpj3
- TLSH T16895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 98ca077a3e88f6fb11c3fac4f39dddc3d5059113ffde41165afaad9ba2fce6a5
- MD5 37b1818d34394a9f343fcfe75f4ee0a4
- SHA1 90e3863d218bc4c112d0d129fe18101b0591bd8c
- SHA512 24ca44dd87d25e5188a8a3cc6ef1e77fdd4bd43e2de5ba2790a9ede169c37367405f79f0396efc7e6a512789bb1af233960a26704b08931f8a4af05a21203900
- SSDEEP 12288:C/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1345523D2558955B1F6FC0039C6764428F5882E2DEB5618E3E3083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 c78b49169b00d6b26fab412b9513ad9e62b006dabc2a90d952dc7f6d7f45042c
- MD5 5b93cb549c0a75a7f7397e031ef6b1eb
- SHA1 048a4cf1a55753d77a07329214b705f91c63255c
- SHA512 b203b009d2db95988e7ed25adead55b897ca851371a77a7bdda75c4851db06c0cce9f270188cb76b824f41ea935215b8b40c78a67602cde0bc3a1e6c2da763ca
- SSDEEP 12288:DsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T17B5523D3548955B1F6BC0039C6764428F5882E2DEB5618E3E3083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 e4a5c4af9ea7d9a741ce77b2152a759b23e1c3fec2c1dc16023856c83d8853a4
- MD5 07150215cd1b36a36ec6c00eaf9e9246
- SHA1 0169358d4f5e56f25a447b6b4082bc3437dc1f1b
- SHA512 76fd8137339677bfdca10ef7cf793c950ec3e7221e788ffe6daf31a6e84c7fe2699aa958a5b7f18ab0d12ce46378197460ff1f3a6ed0aeb30395b8fe4d288f06
- SSDEEP 12288:jyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1A35523D2558955B1F6FC0039C6764428F5881E1DEB5618E3E3483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 17613f7636817a66af1e653f541e0358f1f1aeb42c4b16d1847e4a69ce8e5c4e
- MD5 aa5b3d1e0419efe92375439ad9b547f2
- SHA1 3778ef33e24edbe71e95ce4a046e2739f7cc57d5
- SHA512 2f917768dad0fade91e2f73867ed828f6a5144520d497d66a71f9b2dd448428f6c23b667d8a105c5c52e2ce3067b535eab0bd2028ad380563fc639711324ee49
- SSDEEP 12288:WVFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E1552392168901F1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 34be386ad0066bfb9ea24bf350ac98a28b35986bf63c6e74467a4119578dddc0
- MD5 4e314e135b18391df699e00cd0f53b25
- SHA1 278e1611b491e64e43365e8ee3f49a4169c653d0
- SHA512 3bd8fbdfbc755a4b043f434f463914e2dfc5a079d3124a7c9f6c069d04d65da0df62eec5f0f73750b823e68129853ff76b0c12f3e3006cdf4525405232c2a154
- SSDEEP 12288:+diJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:+B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1615523D3548955B1F6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 ad5b71d9de654115ab9b11ad09bb859e815cc55a504144d8e41be53c89d838e5
- MD5 e47bfbe8fd7c9d6e587891192d9dee8b
- SHA1 c7464518c3f5ccac880bd543aa231ca7acaafeb5
- SHA512 5ebf321fec11c40c025e0864d4e505458240548a2bcc7a6af7ab2b7bd7e53461727672f684d9c2b476d4ac61a772a5d4be4d17f0c44e09706ecb54f7110c6b8f
- SSDEEP 12288:8wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T10D5523D2548955B1F6FC0039C6764428F5882E2DEB5659E3E3083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 8c4d990c31b3c964c1ba8772cb39fcf2ab5c863e4db2badc62d3c2a00d6c9045
- MD5 264320d495b21d55d610cb7b007c2446
- SHA1 de419f044d97967415362606675fe8468dd3a7f3
- SHA512 ae6c5653823f94e671461e9741f57a9a7e099927697fdbead411cd286bfebe3d89d5e54e88781bc0b3ef119eb04286f16f554b3aa32c081e8f951da500685cd5
- SSDEEP 12288:vEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:vO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1515523D2548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 17e3f5849bedabee15cc3cf6902bbfd9813ecf8b36573542e10d68068e803e28
- MD5 b6e3777cfc98707a535ed7e5ed36209d
- SHA1 1f35ad46fedaf9cf86bb445bb324cb33aa3e8af8
- SHA512 d2a1d48fef1b22e3ef65dc1517a2d6018954ef3cb284778ba3857f134b08e41150331c7fb799c1978e09e39a951e797c3f61431550f4242b9a592b35787e26bc
- SSDEEP 24576:YZMRzFVSO2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YZMRzfyLNiXicJFFRGNzj3
- TLSH T1FF750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 188aa97fe889ed17a05321d5b8f3917962c6b282d0e03581012db657bcc7e045
- MD5 0ff0e6cc8f25abdce786b31dc7f6a7f2
- SHA1 8786be1a8602c064285b60a5472ee8faef453edc
- SHA512 831058cfa62212eefce04fe8f811fe98e893b575a727a1cd996836622d6bf5df99515eb8e1b39d37e0e416d8f2e1a88870a875fe3ca140903c5b6727de636028
- SSDEEP 12288:dLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:df/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T18E5523D3548955B1F6FC0039C6764428F5882E2DEB5659E3E2083D1EA278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 b891b45c2fa49e0890f238fe848060917dd8563a70131aeb342179ddadf4ab9c
- MD5 567f16f7430aaf981c69c497c10be075
- SHA1 bfcae1125bbb12dd7b22cdaccf36cd2daa5b083c
- SHA512 c21f39bd6400a85174de016cb83d7c4cf25ccfc2ddfa1fecb11984251f65dcc8477c4b216312eef2a16251c7471af781b014b190f9744e8d548846deaf741b79
- SSDEEP 12288:jHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:jz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19A5523D3548955B1FABC0039C6754428F5882E2DEB5659E3E3083D1EA278FEB8F38476
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 283ac35deaa6a4bf9e288000789b3ce866e529c8ee84d37da575ee26fee05fda
- MD5 94a1c27899376577808c5873de0ed54c
- SHA1 8662ddc9a50088e9cf1afc0536a66fb23c1892d6
- SHA512 44d4bed9020edecfef8c8a15e1707cc8b877c1aa1813cece656a6d286076bc1c3e380431f527d80cd313d805e3258290f5171831e2154cc71181fb85ed6afcff
- SSDEEP 24576:vzyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vdLNiXicJFFRGNzj3
- TLSH T149650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 649b22afa1e420ca1997c84e828a7a3bb9e0d0800ac8d112742aefd856730b2d
- MD5 d443c4d4fae92441292334712297b96c
- SHA1 051314a290e31d3a4d88d0ad28ecc77874f1d855
- SHA512 0cabe865a759ac3faa77aa9b15e6f991d7ccfc78956c37a64b1bb33543be3e38c3269a98dd3009bb781b0ea4d3524dc76b1d1bdeeb6821a18ffc247c2cf64e88
- SSDEEP 12288:VLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1DF5523D3548955B1F6FC0039C6754428F5882E2DEB5659E3E2083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 742aedbf88ba2dc8182033e22bb7d90d41ae64ce707feae461c7b4e4e36fb998
- MD5 9bf388b564a6d66d670339255b5ca24f
- SHA1 c9caaba02d0541358652433bae646bd5b3b6a5c1
- SHA512 70d75dee2c0065a7fda58c2b1987e8c468b88c939f3a236d78d6d25c026fa472df94e1bb5c102e3842b61388d12a04e63148e382492e09cadeea85a214a26c9c
- SSDEEP 12288:ILiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:If/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1BC5523D3548955B1F6FC0039C6764428F5882E2DEB5659E3E2083D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 f39b566975dbe1bd2fc6ca012ffd9a7a1f7e7ef7d074c62532bbdd4011ce3356
- MD5 a95db4cc9c3caf6c84f597b95d7716b2
- SHA1 67c139aa616d4293324a63312b33076e2523029a
- SHA512 afa2bca7ecc97327260c4ccdfd3b6338b2163a7fc93f184d0ad952636210733e4c215776f65730bc9e574da45c12584156aec3c045cd44f0bce63f92800653a9
- SSDEEP 24576:DzyK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DdLNiXicJFFRGNzj3
- TLSH T19E650247629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 0a279ef8e3870ea4a41559585cd25dd01a443dc218e2b65617069991015cbcf7
- MD5 956bcc591f9d3b67fa001033233ccb98
- SHA1 4b3c3d5b00c3875ab253f47e94491119fb574aff
- SHA512 9f55f4bc69ad1c8a41fd2086a28ca8920da3077214e80caf6d23429ea4c4c56d5e660262da345442844dd15fedf8e9bc9a931cfd2cdb8811dbfd71c7b57f4345
- SSDEEP 24576:8TDaLl3z0zDE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8TuLlj1LNiXicJFFRGNzj3
- TLSH T1837502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 081dcaaba5795e86cfee4ba83f8c2dcdd9223febcdf4ffac8ee6731b522d9808
- MD5 5f78b75c9c2ea6094f8656356419241e
- SHA1 1ba4d1d22c79b3242eddfe00316704cd2f10b690
- SHA512 2c0658c102421956028b2e158845097ccf8bc6884e00dab2703e4692b4057a552c99ad1e17c6f28dcd0d0a060fa1249025246b37ee79085d09218b97f9c0a36e
- SSDEEP 24576:y3vd9CHKy7GZw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Uvd9CHKyayLNiXicJFFRGNzj3
- TLSH T10185CE90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.3MB
- SHA256 9e9ec0553cc3c27fb1eb5b43ff40658e01f8ca498d0e9098a675d051e7952cc1
- MD5 5e271a0d5747fe3b9c1c5af46994c9ad
- SHA1 01b6563ff862e1b61a3a5d986f337b385f280c2b
- SHA512 de4d6dbbd88c9a98b771277872b4e6ceeb627de9cd48a2dc1f8c526cffcdbddd12eb81133cdef24d9c1574e12c4e0d772894c1315112a1443e67a979f31105c3
- SSDEEP 12288:CSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:C0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1685523D3548955B1F6FC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.3MB
- SHA256 6c8b9f89a7bca4977d530cbcbd24722b8ffa55ad54142409f9cf7f464c36fd1e
- MD5 9b76c494f35963788e03017ef42f31e3
- SHA1 26ee8b27241c96fa4328ef183d793fc89d7fc5b0
- SHA512 338d59a37d49bbebb9509f12a177a405090d0adda7b7f2da75226876bd57c0de1369c3c1281342ba141954c59e118c0cbf0e4ea5ffa252ab075eeae65706b214
- SSDEEP 12288:tYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T13E5523D2558955B1F6FC003A86764428F5882E2DDB6649E3E3443D1EA27CFEBCF38066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.3MB
- SHA256 f8866135438236e08b6412c2c55cea55bb6de068f96c527999dd739d2c59eb2d
- MD5 1efa0497d91b97fb302c1faf14845d35
- SHA1 06123733144ea306a742797cab1cbf76ce3063fb
- SHA512 a90d477b2374dc233e05cb3d7da19c68910a3edf502c73f1567fbced80c23960c6a6a6d14e2c2cc3adbf22a6f352a56a2e7d239356606a0a9c9d67fbd75b0500
- SSDEEP 12288:sBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:st/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1CA5523D3548955B1EAFC0039C6764428F5882E1DEB5658E3E2083D1EE27CFEB8F38066
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.3MB
- SHA256 6231de96045c5057c1349fec033875161ed35109a6740beae05fc5435b5f9f0c
- MD5 124919a12d24962e0ef9b6f3c53da76b
- SHA1 f838602de03fc4830f983fcc41f1edd6eb24615c
- SHA512 5d8b4e252b760e1d8abc043ec602680a665bf7437b9419d7a5fcf925d040db4619770781ade660bc7ff1a7eca1b76b0fa4584031f0b8c3f9f06260e6e6e49092
- SSDEEP 12288:7LiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7f/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1EA5523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2483D1EA238FEB8F38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 1fd21e5df121c332d1f4822ed1c7dff5262aa88e2dfe2364f4732245b80c2adb
- MD5 3818c4604ebcb53b7d95dfbc801e7b28
- SHA1 a1852d6d4b0a2e41201d1a87f23e5d046b385b99
- SHA512 5c6dab30f2adfb1b10a9fb6d6e25adc2c301e86ec7f6211a651e2059848c2059d4707d438eafc672129f2a56f34f6a432d114481d789f0e1ed7ae3c996c0e955
- SSDEEP 12288:5bsfbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:UP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T14865F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 f7e9ce75d11ae72aa6062e673971951c28650f767912fd0eaae1a5082e62e7e3
- MD5 ed79da48ba13e1ab76e7e2121f6601a7
- SHA1 40b94fc93aa949437cea24f2c73af4753212b9b0
- SHA512 f250602b60e9b78dca9e135fdfd97d011ac5a92e4977ba44e130208c453299ccd80bb55cab4483ccc4eaa5c0ab65316356ff21334fa0a6e186457517aba73e68
- SSDEEP 12288:KViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T158552393928C5572F6FD103986368438B5497E2C9F5598D3E2043A5EA238FEBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 2a6cf9e033aed05bf5d09bcf7caa393c0ad1e25db24e2d71130cdc321de5eeb0
- MD5 101ba584d6e319356ee79440b141a3f6
- SHA1 d13ba53534b053262224df7edcd7a0dee164717b
- SHA512 14ded39cd57a595f3049c2c64b367966b1bbfd7192f4768bca705e6103900953d9de7b13a5ea62f79b22c35ff4114c167e166882c9b909d7dffedb95fd1efa2b
- SSDEEP 49152:qa0h2GEkuAe73q3pp46zwwQXLNiXicJFFRGNzj3:qa0hNYG4Jww7wRGpj3
- TLSH T10A85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 76ba2910d24226323e6e97870c00f51a41584dc5f4970184ebef727c8b869159
- MD5 67a95dbd82026d74ebcd446d68657ae1
- SHA1 42a6b99eb60b9b520f2609ae70e0c436567a7bab
- SHA512 2cb7bfb7f651c321258bdab4c5378131a0f749259483a98d310f041231f033e7f7e1740ad4fc53dde7c9fc029f28fa73612f11527ba51d916604bc5479361d54
- SSDEEP 24576:a3YgnJcRTk4yti+R5dpR/E/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aIgnaTk46ppR/ELNiXicJFFRGNzj3
- TLSH T19F45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.3MB
- SHA256 1916be12269493935d8872b60ba9c9e7a956c1add5d43adb2b7d161750668ff0
- MD5 7236e7b526f75ac99d9749c325a697fc
- SHA1 76af9b446d7339e961b14889b5b939ccd0d2ea8d
- SHA512 3faca145500db14783825c2f9ea1eb50be2e9ebe3b1be617113d71c2a8e254f01d46ba8ca6e6dedcd56d141c8eb4eaa837e713503f2bdb556be8eb880e299554
- SSDEEP 12288:c5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1645523D2518955B1EAFD003E86764428F5442F2C9B2619E3E1543E1EA27CFEFCF38562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.6MB
- SHA256 46100432778a80b944fdeb5425cedda93f97f758f680929ccbb01df12efd81d5
- MD5 49c7a59de8b8254d4e4680a20c36c606
- SHA1 4345784bef282aa60daef4b2ec78b30340700678
- SHA512 cae55f1cd32786d3059722a61e3164ac8d0c2bf0a034d146a5a27c475bd243c8a3a5df2e27257e6570c465487331530264ad6808fe9d114c1fe50a47965ca0e8
- SSDEEP 24576:5bL3UTq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5bL3UmLNiXicJFFRGNzj3
- TLSH T1B9850155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 6874c6e2a4c3ade083041f5560e344634e3a5c7c358be82738bc073cd40cd03e
- MD5 115d33e50e7dc2f62fa81f1793cdb4b7
- SHA1 ea6bb2bd6935a382c745ed598604f7486dc1105d
- SHA512 ed6e5453ab8981770d77695dcea532b30be2ba46e3c9910f8ce678889c86ac6fd3d59083391a12b0e49535bd31acb7f1d75c2b7314040c6b31eb133deb310371
- SSDEEP 24576:SOG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:SOGLNiXicJFFRGNzj3
- TLSH T14A65126A32DC10F4E579903D8AA2820CE371BC29072257EF4290557E5F77FF89D39A62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 2e96283b2c5f3bf7ffecaa4b8c75278e4036f96a2364f580c9ec7c38a1019c85
- MD5 35954539edaaff8104599cfd8ecfea20
- SHA1 01cf174317a8d291f1955d66664f9c66fcebd07a
- SHA512 af43fac21a6bbc99e6f506976aa5d4dae6c4085a6c1fdd162adf38b305b39aa5270d5edec1898aa9f554546910749d191673d33ee579a44c350c222d1531751c
- SSDEEP 24576:R7NM9YmZqmWMUkPjZM48Mv6bEhsJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:R7cBWMpPjN8DbEhMLNiXicJFFRGNzj3
- TLSH T1CD65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E6F37AE44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 c79c68b6a8c4ea2078694767e945fe3d3992e117272e3ae6c1b388ac1ab43cef
- MD5 e60119b46b6697201fb28b967323aa36
- SHA1 fe525630efb972aa722d651cdddec38cbfcfa877
- SHA512 cc7ee72058f4c2b10e2228e708e316a2003ea6b22064974e9f3563b4ab97e21481e553c49174a7e6191948664168cc9ea6046f2fa82f69136db48880080f40ce
- SSDEEP 49152:KF2YuHNETovcvNYf8kmpLNiXicJFFRGNzj3:D6tCf8kG7wRGpj3
- TLSH T1D8858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 3eb4353ad4e6dfc646dca598fd5401f591fcd1475308774b8f682059c392fa70
- MD5 261d3fdf7d36fa23b84919915c997e9a
- SHA1 c2d2d30ccfec2bbdfcf33742655bb9025891517e
- SHA512 ab1fd10954ed2323398c052ea17f0ab74abf3f2103fc1cf796fb05abdc9e2f0c8242622c7bc5bf4c743527f5bf211aa01e5e6773b24534b2a5920765f13d6d64
- SSDEEP 24576:DAFs06+OmlfkNXEbToS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MFs060lwXu3LNiXicJFFRGNzj3
- TLSH T1C265BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.6MB
- SHA256 e71d9a7fe910ec7f4f6100730a016ba84f2d59ea190077c05e0a2f13449f30cd
- MD5 609a1761840758e023e922353c0cd546
- SHA1 1e71a1d2a7878e748c109ceba5096e9f9700c906
- SHA512 c0e40ecb5a2d320c5aa982c70bd89e83ca7a3f61d950d156f3604b65bb5863e49e8df81999513f69a337a1dcfe3de3268633ddddab1009ecc9db999ae8d7519f
- SSDEEP 24576:wJnJ5D3Wt3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wJnJ5DGt3LNiXicJFFRGNzj3
- TLSH T1BB75D02DD2A810F8E4B7C274825A1A55FE72383D2F2269C724B4D5357F22FE09A79F14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 646188f0fc31023f9bdcf0ef99f779b06c4c92d0eed7ffa4bc3f7d9bd5c6bc94
- MD5 0dc5b91362bb91d6807a0a180ce5bcca
- SHA1 f35f6cc9625d6321e5a9d6f5b7033cfd3c72afb4
- SHA512 254890cfac400803e8b2533493483d02deccd5daff35449896feba72fdcbc32d70870f07adf40d9695238c48c78bae85d137664139feee259db5ceb58abd8cdd
- SSDEEP 49152:Co06DIKdwc+eQnSt65aVtLNiXicJFFRGNzj3:jr7wRGpj3
- TLSH T172956C16B7EA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1E33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.4MB
- SHA256 7d73839490d7c4a006928871c147a45fbfd30f1f718ab79234e36ec15e78c28f
- MD5 1563db97b07ca31c8674d36c455ae06c
- SHA1 24b2cc27783667add4eecd49e064010daa046ef4
- SHA512 94c421c1cdddaadd6936df2dbd7369766607de5efedd24aea3f335a2bf0b6984bb67c9629964c79aee4c4c0228325905087eb28bd4eb9142ad0c78443c0fce9d
- SSDEEP 24576:TrK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TrKLNiXicJFFRGNzj3
- TLSH T1A36512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.4MB
- SHA256 89ff206bede6c122a5e65c79a2d83053ee0314bc5967320d7c8a71d86c5bc567
- MD5 3f1744ab4e5946de39c0655844e8dabe
- SHA1 342782b7e45ff5fdaf0026e540f7bf0208c3a6bf
- SHA512 843d2621e980cd7fdae7b038a9b8198938bfd7b05cd89de914bd3ab0d4ef5127288586c255911eb23601fcb7bd3a5c6b4930e58a1e179a51e8616a83a715c549
- SSDEEP 24576:pIyc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pIHLNiXicJFFRGNzj3
- TLSH T179651245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.3MB
- SHA256 fc486511b198b9e8f3dc2369e8598258547e2ed0bf49a38390d65031b8b71776
- MD5 ca9d80af7949b31bbeced0faaa128b4e
- SHA1 bf7d455e4dfd7454d4ff425865227b81d5d77106
- SHA512 3daffc46fab7c2077e7689d8047380db59b817fd6bd396ff6d70ff308f8dec778eeb3676ac25fecdb4ca73d3893efbec532a0b021b6571812abfe918696487bb
- SSDEEP 12288:yFMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:g2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T19055239A118965B1EABD003D86364824F1543E3C9B2618F7A1947E3ED339FDBDF38852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 e20fb6e31b75e8d8c80e320ab6ac2f0333a70e72e126baf21b2f58467ab2a934
- MD5 ef71eafbbc948754abb98b581a85f5f2
- SHA1 262c1343f2bb3cc987c3f2e7ac7e21f7e580df88
- SHA512 0a3f69aa3909504fc90f05a10f7a8e13e36336f484ed0dea966e58d3ff28cb077b7af64eb008519f2b2f3f7bba99112b75f4e6350fa56dc483c076fa9e45b2a5
- SSDEEP 24576:PQ9MxZKdcz97w3R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PVKXRLNiXicJFFRGNzj3
- TLSH T1D9558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.5MB
- SHA256 4b21f259212f772649851ca7e9a957704b02a69112ec2f0a818724161490e115
- MD5 3b15c5c3559b96f9fe5ecb8c0d1afa61
- SHA1 3d2d62e9076b472c4c6b94d03f33c70741d3a445
- SHA512 9f8424ca8805a64ebfed2a5c863c92aa499dbb714f2cea768d2f1013afd22967a837d080620572a7b7ba0bb2801edebfd08d3213165ea8082139297e5b5ae71d
- SSDEEP 24576:7yocxAp4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uocxAp4LNiXicJFFRGNzj3
- TLSH T14D65E05FB76D40A2E176813C89858204E773B4345B6257DB6281C73D8F37AE9BE38B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 edb12daba06664fb97a62a30afee1872c53628a6ebc384a060c5525bba5530b6
- MD5 08c3a9dcbb698a14c93771fd102e3777
- SHA1 c23cd45fbbc1571d376570b61639aaf74ab73bc6
- SHA512 64601ba846e1cb2b933f1a3eab5ba3db5bf7cbf82e28008b143329e0f9a95f97ba995848015ca99b51fb98e15b287e58d49d4bee041cc49ba2747ca2b218ee56
- SSDEEP 49152:dWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIK4LNiXicJFFRGNzj3:90zuNI07wRGpj3
- TLSH T163A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 b8e87fc271804b48a471c0003eb464c98697f2211ff520cd33bb57ad031071df
- MD5 7fd5d0569721b0ef8d196d7f806ac768
- SHA1 064f6ead0120dc92aedd9fd15ba192a74c73791c
- SHA512 5b7f7456f3fa2e03fac19ffb7d209fd8a6d50f670141c1cb95478c170c1a276fab2e2078fee014a4087104c3163b6b2f679aa8773d1e8f2c1b5ac08de5bb86ad
- SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYujMqbK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NTDxR+N5YzT4jMDLNiXicJFFRGNzj3
- TLSH T19355B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.4MB
- SHA256 e5f614afafb11598ed9bed592baf39b35b2a8dffb665ab6996508f7592749deb
- MD5 64b71934cd5d3940d4d5fc3709a23506
- SHA1 9dc66cb7525740297684a2e92fcfbcc99a570aa0
- SHA512 17c52fe83a84998e91b8379cf21253f4b83e61090a60b8a76a5874c3b86abfb1800a83911c3364a019911d331836b552986a6437c85b4270009393438c82b052
- SSDEEP 24576:5hbHjP1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5hbHjdLNiXicJFFRGNzj3
- TLSH T1386512BE129C20E5F6B5903D8566840AD370BC29172197EF6381527E4F3BFE94E38B52
- MD5 SHA1 SHA512 SSDEEP TLSH