a42b50c5da2d36505ec02c89b55cc091c6bb0ad12452bb56f98069724c03b32f

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
Size 1.4MB
Sample261102-e2gwnag17j
SHA256 a42b50c5da2d36505ec02c89b55cc091c6bb0ad12452bb56f98069724c03b32f
MD5 eb22d0cff264ef477b5b6c77be76430b
SHA1 d5e7934c8773c5383e77c67106e3b28e113cf8a0
SHA512 9bdb701abd7749ce9501bb2ea297e9569ce9036667c3ea8b92a59c0bba831dc54730b961d09c2835fb3d59f7b58a148c62779386c8a6efd34c1abbe4fb00cc9d
SSDEEP 24576:/O1Iz98QUZCO5OK+N9NjzABgioiNV99L5S1fd0b:sIRrUZCO5OKE9NjzQgilV995S1V0
TLSH
T16F65020275E2C8B3E6B209364C78AA6669FD7D700522AF7F53D40D2EDF31A81C625763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4680	alg.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2040	elevation_service.exe
3920	elevation_service.exe
2540	maintenanceservice.exe
5080	OSE.EXE
3764	fxssvc.exe
948	msdtc.exe
1868	PerceptionSimulationService.exe
4508	perfhost.exe
4192	locator.exe
696	SensorDataService.exe
3300	snmptrap.exe
4148	spectrum.exe
3808	ssh-agent.exe
4700	TieringEngineService.exe
3380	AgentService.exe
4256	vds.exe
3508	vssvc.exe
640	wbengine.exe
2152	WmiApSrv.exe
1160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b75be119b11239b.bin	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba2bbf83826add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ff44783826add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000453a783826add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e243b84826add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ae9e82826add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bca81a83826add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093fbac82826add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7a31d85826add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2792	DiagnosticsHub.StandardCollector.Service.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2792	DiagnosticsHub.StandardCollector.Service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe
2040	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1656	2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
Token: SeDebugPrivilege	2792	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2040	elevation_service.exe
Token: SeAuditPrivilege	3764	fxssvc.exe
Token: SeRestorePrivilege	4700	TieringEngineService.exe
Token: SeManageVolumePrivilege	4700	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3380	AgentService.exe
Token: SeBackupPrivilege	3508	vssvc.exe
Token: SeRestorePrivilege	3508	vssvc.exe
Token: SeAuditPrivilege	3508	vssvc.exe
Token: SeBackupPrivilege	640	wbengine.exe
Token: SeRestorePrivilege	640	wbengine.exe
Token: SeSecurityPrivilege	640	wbengine.exe
Token: 33	1160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1160	SearchIndexer.exe
Token: SeDebugPrivilege	2040	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3956	1160	SearchIndexer.exe	118
PID 1160 wrote to memory of 4316	1160	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_eb22d0cff264ef477b5b6c77be76430b_amadey_avoslocker_darkgate_elex_luca-stealer_lynx_njrat_play_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4680

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2540

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:764

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1868

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4508

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:696

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3300

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4148

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5072

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:640

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3956
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6e24d340a404d6292657bc495356ed905670fab9b4d6d838717f71ece39b8e37
MD5 69d5a2a104905468809dc469ea3394fa
SHA1 0159f7b3485308cb999224966be4acada60cd35f
SHA512 1e3f629b7305758d02312096b5d970d509d5f1f13c6a9daf629cb937d247594d9bf696b35b7ee60262e42dcf031a16f7f60de8b0e8214ba62da3e5a48b63a8e8
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLjzQgilV995S1V0:P3q6HjBMjI
TLSH
T13FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1204136c49c05b07319d3eaf6e704c2c94cdf135d9876f7a9ba1e786be85b9de
MD5 e6858a34b522142e916167e67d0b4728
SHA1 b8ecd8f00a8c72323daa79cf247f2e28f8e10667
SHA512 85b54106a6c0c3c396c563a8f4fd287b253193db2e4d3b67e2db72febf51dcc8adc6581a9b5b76b1f5b72de62eeff7e3878105625f63614644dfe9377dd5106e
SSDEEP 12288:r1XLsswWkxy2lRq2czA78jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:RXYfDtczAwjzABgioiNV99L5S1fd0b
TLSH
T1A765F12963E448F9ED67817CC8A1C506E6737C914760FBDB03E489261F236D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 06dee2a1ceb1443e1deb4d656cdf0cb04c255740f94b384be812151aeac0296f
MD5 fa49906084dd872facc4325065be8d31
SHA1 60591e19cad716aad1f96199ae7b20270bbd814f
SHA512 aef62d54d0a9ba3b61d21d3b14895defa0b11f5b02687b0fe54751240edfd690cead75c92ba92c3d9dbf8481bc13c4a162adf48cb11f0af1f9ab9dadf3e59ab7
SSDEEP 24576:d0Le5ji0hmxirMjjzABgioiNV99L5S1fd0b:dPji0Ac6jzQgilV995S1V0
TLSH
T1F5859E56F6748735D073C0B9C5D2A68EE972308257308ACB4286C77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1a5848b6a2ad6531a9d385c78cb0f0737de7377eae7f87fc0228816107b715a7
MD5 1b4511bcef1e0eb7493094e155228c89
SHA1 0da96b97bae1e6b78bb7ad6761db326324c5ac6f
SHA512 dd953f20af4148344ebf93936c90c9b017af17d409a9dc3d6f14e3dbb27f1690714da5b87d119aa63211481a83eeda07bd4d12f3852900b77727b7f6312e2809
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyu5jzABgioiNV99L5S1fd0b:m/ezSC6vUzPvxHjyujzQgilV995S1V0
TLSH
T18A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 844ce00cd777d5d27dcb7acef4beefee6ff4feb8a95f6d991680233874b3a6f6
MD5 3421b1ce3f37bd0c67677423f8da2316
SHA1 61261943f384018dae755f566e296fdcc37bf335
SHA512 53e966e3ccf27ef1fabaefca600efdf84ee80ecce383c0f1927566beb1c8cc98e5bef0c0eb717757b1a2dd2f01df2c76ed4d748e0d1cd1434af3b87063269c02
SSDEEP 24576:kVbqPb88hv/l+68jzABgioiNV99L5S1fd0b:kVO88hXl+3jzQgilV995S1V0
TLSH
T168559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 26c68493579819e347c34858f1fd2a34703376ff034606907ab7c630332eeb4f
MD5 69dc3e0a6fa72a0e3b532b98bc370d9d
SHA1 c345a9523cbe114b87e6664f4051c5d04891ad87
SHA512 e341aed2dcc9fd4f2c594f391739ed82009543dbaefbc73db482f56fe144ced92ff9eab1112ea9f3ad0f562e7f2b816ea828454aa7f6fe018d4ee69887341de9
SSDEEP 12288:TRm8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:TRfjzABgioiNV99L5S1fd0b
TLSH
T1E44523C79368C8CEF3750879E4A8F80FB0B36DA086407E9FC3E1186A5DB9DA1C515697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c3a8395f96d65cac99a95ff56af111092a87ff15997f041349403ce8ebf11980
MD5 427fec359c2d8634aa9e11f114e06233
SHA1 3ea80f34a280f4d8c8bd4c4be7aa291fa448c043
SHA512 03ac5ced9771a237c9963937b8053baacdbe40ce3fdb0111ce785126df33c33020cfec3000cd5e075706796b0e2940da56667d0d4a05e56f2f0e5035af6013b3
SSDEEP 12288:ReBNUbTVO86UP8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:RJIU0jzABgioiNV99L5S1fd0b
TLSH
T15265C07BEE28ECD2C27A4DB85A91C600E7B278704F51A3CBD175820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1f0cf1644f4c025980904e88965e98b140277a1525a32852a286d8994e9524e
MD5 3969fa000382038c820a5e83fa9f539d
SHA1 5804f8ef22afd1597c8dbf7b23f1d53995a66484
SHA512 0371a2b7732a103ac0d09958aed85cfd74b014b0e06797cccfc25c20648a71a352f3a908d123f487bb9aa978177bd18ffc444685c6425f8ebf41e331e424b2cd
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:OQvGAdlCEL8c/yRNw5CpjI
TLSH
T199266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dfbd51acb41996058ff722c7b6e0585a5268aa299793125d18d3c270a736b9fb
MD5 0a35614b51ba4deb55dcf6ed3decd886
SHA1 e3784b0b2174b6ecf16e3cf25a2a45eec5732d6e
SHA512 5998551f7ed10759d6c5166574cf98c6dfb91ed98ad27797fa6b9224bb89be99171f18e3d27d9926c0cbaf4fb2fa5f34bca345d1e00646b9fd93f037da2ff05c
SSDEEP 12288:1AwSfxL/2Dc34DLLmt0LDQewsAjJ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNf2:WdewsAjqjzABgioiNV99L5S1fd0b
TLSH
T1B375F031FA74D436D3BB0CB61B35D70A247DB9204B612AC3E3E84E9E59706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b29717e194e9a983d7b3a55f25f036178b486719797bd809e4acd56642b86fd2
MD5 ea4ecaf4fd58206f16249d8b0f4f6511
SHA1 37aff47fa1539eda10c85b429223f745cbd4b3b8
SHA512 542e1c13ad6e7102dac03ce26373a9bc96b1648948a112b9815a5124211a1d9701e6a8e4eec3452e72c13e44fdd85b7180ee07392266d9bcf6fa646f28b84324
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHy:AUEtQevvqc2W1cpV2EI32
TLSH
T1C8474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c9b5d74dfae8e7f7c28bbc264a464b669c9a9e297ccd8b6debc2d0e8bebe4644
MD5 a85c28763388f3ab51eedacd67cd7796
SHA1 30f4290489f1ea1b00e5b779aca9fdcbf22f6eb8
SHA512 6d7b2ec4d515cba09bcac1fe75ecaf31871c26266f897251f675baec4d476a1a08847a6afc4bd3bef53a1edd95053fd62b486f422f5c98b1af987dbadabcd616
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zKjzQgilV995S1V0:6oqtVjnmtjI
TLSH
T136D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d1b68446a5b58aca14802ded2ef29909f6efcd339dec94dece268d30fd987e4e
MD5 a71ca09300eb93225eaf230ae30e7bc7
SHA1 a456a2e859b7f9702500a06dd28ac6ab81a3ff0a
SHA512 4799a0a266ab5ba13c833f007db7e3b3bb87ea04e0f8ea0ab4a214a32f669cd6f4a99676231156cc1263bc9c5f1fd128786f650372b8b062e243735f31637e46
SSDEEP 24576:/AhGLJIFoiwtA5l7S53NjzABgioiNV99L5S1fd0b:/AMyFoiq5djzQgilV995S1V0
TLSH
T145359D81E7F945D4F5B3AAB899B69171EA76BCA65E30D20F1260C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 981e65b74ff24685f7975d4330be97d1598afcb7837547dd69771a8297f0ec87
MD5 65b8e79ff48a837816d77a23dd79fbad
SHA1 f23d040fb22999fcc2ff60146af5e579bbea1951
SHA512 a7602cb73898de5b07675f9ac2932d6b09b8ec4341a1fd1001a87978b030d51c12f3d8b2bb9dddb97336bd2f880714b8383957022f788beb6d9373ede77af589
SSDEEP 12288:pmw5HEjsChNVBFgl0WDm+Cs8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAP:kwuoOWOjzABgioiNV99L5S1fd0b
TLSH
T11F65F14672A84CF9E6678138C597D536F7F3BC112A20EB1F43A0C65B5F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 35a01a073eb7cb5686e6dd8aa5557fe206263181c8b337074bf00d6cfd8ded2b
MD5 a54bce079fb2eb9a2626de21cec8ef57
SHA1 dbb3c316ad3ad30df070955aae6371fec5052754
SHA512 fa22645840df3ed37807fa79b0f608f93ca6d3406c1662f66dbedd7ae754fdcd21dd531d6640ccf7d491a5b222a4d51afec7616ef59896aa65e6da6d6ac2615b
SSDEEP 12288:1BZ1IyZ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:jZu7jzABgioiNV99L5S1fd0b
TLSH
T14055128A23A890FAF263457CC8E4950AE3B37CA2573167CF4261056A1F77ED18D39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fdf5ed92533e1622eca879225b39f69bcf6442c6eed2b0a433b52d0b542e6d4e
MD5 39c8aee84eb92dc6bffac323e4e99046
SHA1 35b8edd7ae0938982a322c624ac3ee774941ee86
SHA512 378c3a9f76c773c4f5aa41e0b0fd57ae5141b288f75b9d0aa174722ac8b236f5b623b48e82137e3c4319dd4ed15e41320362eafff114de4ba73466cfa9378ed5
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:LQRQyi36YOcPQLvw2gAf+PN3IjI
TLSH
T178667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3090d0c9d74292e8a9fcef996076194df306a80ac9b97e01db8fb84eabb80b01
MD5 b3b4cab2a2b85e214662546f2e91b013
SHA1 b4e69012b05e303106fea8d12cf843c81f18ade7
SHA512 99af6b40dc886bd8373cf0a77b6eb64d0d9ae5ba83247d88adcc5ab9c0b9a47a884a6c3ebb875320ef521fbb697771857d9507e65ad1599142ea48d436e3dae4
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ux:5QRQyi36YOcPQLvw2gAf+PN3IjI
TLSH
T15C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1f70400e081562025631c92b965a1755c1435071187d8bbb549ae0111f7c636a
MD5 b6cdde48d63c6f138f07dd84297003ae
SHA1 f5db1bff561b95dfa2fea437cc320d94aa1e1ee8
SHA512 28004aa7476364742dea7ea608c2666d0307ef78d0d99f02d6399fb9c6179e9b4a59af166390915328310c19dff8017e441fd4279060a9f8471ce7af8a9e693d
SSDEEP 49152:P68Qg55nhheWu7PNU3/6jzQgilV995S1V0:JthWRc/6jI
TLSH
T13BB55933B2F60099D44DE1769F4A972196E27C718FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dff7b94a67d5ba3c56ebf27cd41609966ce454171146476a69bc9669fd06ef81
MD5 5aefd557321a483b845560939dae3ff9
SHA1 9e33c5e0a3575672b4b71831d049b30c5e95c51e
SHA512 0f3b4383b5e4a4831c3d09cd57b71ad592817038d59a5783e4120fb2ca89e6b2bc88f8b4033be82af3d7d838213a62913ddb4144978278d42d7b29065ba60cfb
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:sy5112gYy5azzVvL69nLKnhZfjI
TLSH
T152167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa8f4918829c7e78458ebff2079999bf8e8a234a061bc0ebb5958a74cfacab58
MD5 ce707f77110c5313ebb7f3ab1c18e2ed
SHA1 0e489f869cbf8ab4e9d10928fa013f6a01c1d741
SHA512 3bc6b06c011c17bc5079b0c7670b6a40f83c9fa67e397e003d318d99e968b0bb663e64bf1fcc4dbe246605728b979f47854af28b83cf0194987aadd0409fb967
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAjzQgilV995S1V0:lu6JmVxd2dAjI
TLSH
T130D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2d64ba73c1008c1aadfa5e0d84edca9c8e768ec0f19424c7ac942226776df674
MD5 0fc163cc1896adaa7636c217f2c3557c
SHA1 8e456ae7463be4d20c8cc08ab3b3b946798b8a6e
SHA512 e382ce5b57af40fbcc7cc5269f32b469d079aaed998ad80e186c16a5fbc4e90ee2ecc1a85e9c7f99cfacae539fd275814ca3aa0f50530376842a3947f4214f3d
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xUjzQgilV995S1V0:OmifPbRtjI
TLSH
T143B5AD13F29900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7e1ead5156d062097cfc5ccb1ca027695668a3d9b346c8aa468a1052e81fc74e
MD5 102fa380c78d857532fa3c0ad8f1e6f8
SHA1 00a49d149e444761c78d04495bd0bc3af40ea111
SHA512 b6d383d6ba20aa959e0ad51f653530bfaa043954c729704edb82414923cf16983f810a9d02fb947ba6f9883b18af419e6930aed8ad0fb1358cbb35f12b35fa0b
SSDEEP 49152:CSuZQIY0Be2KRRVtOnks6NMHq7jzQgilV995S1V0:c5dKTi617jI
TLSH
T19DC5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4f4828f587f3f6dab77f4cfdaa924bbf9786fc84288403dfe9858d356094969d
MD5 6a1bbf9b4bae63eca8329ba1f6fcab97
SHA1 a585ff41a10bbb61af2b7fda29442f141dcc6f4d
SHA512 591ab09227ee363ef52ed7f6e48bf64a83e01ae23c206ccdd9f94eb172a645db612f5ff92d6ef4764213c10af936b8efbedb0f10ad20999c3fa4ffb213544aa9
SSDEEP 49152:1htSn8EApI0figngiDn0AP5wwjzQgilV995S1V0:EX2iyphxjI
TLSH
T10195BE13F2D940E8D06ED178C7468632E972BC150B35BAEF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9a3e7a72d2a631859fd6b02846c3bbd40a4fa49762174ddc11054e7b14fc2d5c
MD5 c19379557c874cd669ff573aac8858fe
SHA1 5b9afed27d3432bccaea0c6df35b28288cf15e62
SHA512 db7aae6ce120a21f2df835e8fd62b9fea284da01038594107fba221b406ca1ef9caa7d5258e73f5d99394d97b96cd23e986596949c4e37d6a74d71f5b8a8198d
SSDEEP 12288:pO8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:p3jzABgioiNV99L5S1fd0b
TLSH
T1114523CB9269C8CFF32048B9D494F50FF0B36CE596403A9FC3E604265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c35269d9596d6bddda2ed5a2e8d28b58b8408bf7b6a753d5d5aecb19a9d88f1d
MD5 0ae0f47652ab19243b27d20e778e9998
SHA1 8cf7c652bd77ebed03d6d693de516fd1c46c6725
SHA512 1587800598bc5b4c46414447687a5038f8d4daba634bfe4521000df5d70ce8341bc025fed6c859b8da3fa1a8e0fa7afa3f2ba341312c931f2a8295480d906f15
SSDEEP 12288:tl8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:t2jzABgioiNV99L5S1fd0b
TLSH
T1004523C79269C8CFF32048B9D454F54FF0B36DE696003A9FC3E504265EBADE08915A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3691b5e62a9ed9418d9c242d1e3697ffea3db0f88cdcf0c67a08585ad5b19e96
MD5 b6b2e126a89cd93bc2e011fe5c0a1424
SHA1 69b6de14088ffd8eff62713609f9c1ff37e81a39
SHA512 053cc90f36daf04b2ddcd5e0916008bef95433a3bde05b9b4a779af0c132fbb9b0a9bc614b8b821db8c326a509ff32ec75420acd17e9b6d2b6bda67e3469ba29
SSDEEP 12288:6X8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:6MjzABgioiNV99L5S1fd0b
TLSH
T1CB4523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8d5e19acf097a308271981b2dd5695e33ad2fae8467f62b320e752f0f137bc41
MD5 57c18166117b41bedc05705e182900bd
SHA1 b517e676df51e792755338e8893d7df1c48e1853
SHA512 7911e06f546821b27fbee49cd7ac4b9b47cc19539b4e6c9a955b9aa9746feb46d326295b2995cc5406966f98d87682ac5157c2c78083fa09705e8f617e2f5558
SSDEEP 12288:cVQ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:QjzABgioiNV99L5S1fd0b
TLSH
T1104523876369C4CAF2718579C460A50BF0F37CE597217BDFC791086A0EB6EE08924B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2ff5286ea4b811932093e4315d31fd37544100d27c0a8368b001b20e026cec6f
MD5 cf8ac09355d0ba2f318d3fbd574731a1
SHA1 6ac27fd1606b586d78bbc248ff914034d19541ce
SHA512 a83948bad97c7ab71deda4ac0316af8e4ba2176279e5057bb00247f09ca378303a3f421181ab686c77771384b5fd776194c287b226a444fbc1755df3269328e7
SSDEEP 12288:gI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:g1jzABgioiNV99L5S1fd0b
TLSH
T1394523C79269C8CFF32048B9D454B54FF0F36CE696403A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 68a0dabfa00d3c091f9e3156cc76aeebdf906fe892f2868572c971a4eef6949f
MD5 0bc90f645197b3e883ef0be252be5d45
SHA1 0ff6cb0117aace30cd5652cde401f95d9fc4cb9f
SHA512 af594a5582a3e326439d885e5d30ee1543f36cf0d0b2fab25875448a2a761d94c6d2e36ba18c9d463207dbee3e30e70e17b6796032ee52db6694a5f60e4b0bd5
SSDEEP 12288:hR8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:hijzABgioiNV99L5S1fd0b
TLSH
T1DB4523C79269C8CFF32048B9D454B54FF0B36DE596003AAFC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 06ef9b4a7a6e5caa8178dc4de2557f75d486f9ed2a4dba75afb4c0b5fc4f0a28
MD5 200520161fa1c8391b8d9ba5cfc2dea5
SHA1 f4bbe6b0c247b65a9fd7966c04a4df40ab765460
SHA512 480ea29cdcbedcea093c732970124fb207f0d431c4c4b0f8deb95b9dc5a9b224a2d838824c071dfc0bdaedf45e859ff0cfc932a342c851d4c315ae3054d72145
SSDEEP 12288:498jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:4ejzABgioiNV99L5S1fd0b
TLSH
T1924523CB9269C8CFF33048B9D454F50FF0B36DE596403A9FC3A604265EFADA08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9f4f168b971438c5eb71c79c81b4da4466dc7e6b90aa99a4648bbc2cfa0b849c
MD5 21effad939226c00993cf464ca6b4583
SHA1 05dabd7dd0ece921d8c4e78b12900d486d50066d
SHA512 89ba22ca59af84ced0d1e9cbad7c2be1ef675db715df56d300ef206ded7d55bdcf58e1c707ced5b0949b3fbaacf047213b652e9831f91dc11c6e10146984a7d1
SSDEEP 12288:TiZwb6zzFEoS2cPvyF8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPAf:+ZMSzFVSOWjzABgioiNV99L5S1fd0bn
TLSH
T12D650195B3904CF8ED63813EC855990AE1B27C6A0760DA5F43E436275F737A10C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8bc1a5f6127be88ddcb348bb27da1723aa63e8820b9e98dd4cecd72d4b9f7438
MD5 f5d912a91d1df22ccde67ad9e3b367b9
SHA1 9b0c41caa09504e5e67ea7be7b3373df78876d24
SHA512 967c60cb092cdd0f55f8d77ab6a411613b620e2c0c2f7d16b7808364cab59f1980e8145bac701a3c4aa0e50aec30d5d0cb91057087ec2885e3f6065353608f4c
SSDEEP 12288:Ei8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPAf:ErjzABgioiNV99L5S1fd0bn
TLSH
T1374523CB9269C8CFF32008B9D454F54FF0B36DE696403ADFC3E604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 09c578468c2af9a1e1199811192476e536b8895ebb35c7e0f7dcb3ea6f20b118
MD5 98aa9016c388c8e3b7064e32828ea539
SHA1 f4b652d59918ea3ec3dd98c65edbecbc8be14eaa
SHA512 3a7b75b195a776138de1132f05445b864708cca26cff167b31889a2744cc4fc0d16e8c25ebf6999150c192a542f5cf6ddb288db2dcbfe2ede312cd149c77f621
SSDEEP 12288:k28jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:kPjzABgioiNV99L5S1fd0b
TLSH
T1F84523CB9269C8CFF32048B9D454F54FF0B36DE596003B9FC3E604265EBADA0891569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 90c503b163c2d6fa17f49c31b69e438da368ecb159a76b6d5727eae3df2a81b0
MD5 fd8fbcec34df1f023d5774cf0ab77871
SHA1 3e67e7e5556b944fa3296ef6a03070830fa81911
SHA512 6c76a0cf4a9cd6f29d78b79856dd50108d0eacaa1d1b220866464cdd4fdfcd359dfdd47f6f1a187d30e632f12e21544eebd896f93aa442f4ee01ffff3d554a9b
SSDEEP 12288:yyPz5L8Z8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:vzyajzABgioiNV99L5S1fd0b
TLSH
T1FF55024773A560FDE1368139C8615906F3B27C724720AFAF43A406761F77AE09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ae5d199ef9ad069b5fdf41ef904e5483ae9095cfde850948468e89e68e1051e4
MD5 8b8de80c4ef542578715337ec7c4d3dd
SHA1 c46d19ce4611465f104cc99f68550c6171db66b9
SHA512 4eb11b159efc066357274a541d0d29a9b3f497d9d40b1d2a9b4b5855469007283c1a6544437dbfbcf35254ed61bdbaa915630a8134815d53e365f927564ad47e
SSDEEP 12288:si8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:srjzABgioiNV99L5S1fd0b
TLSH
T1DC4523CB9269C8CFF32008B9D454F54FF0B36DE696403ADFC3E604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cc4634ab9add8582111e8bc973571227367d0ee0befc339a282966864171f321
MD5 dea0f4d5c2bf747a30699a25c1f1ab47
SHA1 f49c0fcfc4b5426ccee6556d6fdadec09f1a53d7
SHA512 2220d94ed8e5fcd0e48aa117a189f3bd4584a36d2058776e8bc39fa54fcd9b38ac87fb172e6fbdf28435ad4a332c65da21e6727fe3e17ac28fcb992aea760adc
SSDEEP 12288:Ui8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:UrjzABgioiNV99L5S1fd0b
TLSH
T1C24523CB9269C8CFF33008B9D454B54FF0B36DE696403ADFC3E604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f8ace5fe92df24570fca93af436493a28bac8465a1c67de0fe83fc65fe3eab01
MD5 385690aa723187ef8bdbc328451ad309
SHA1 9c2aa19d1e63dd7f91634a95822c7867cdbde7ef
SHA512 303ffdc66d14fc31d816470d77dd64eec82e5bd4ced7783d8317840c82479f38bb500d56327e5079b68cd8bb84a8e8f432e7fd29fe509e957cb63b6affbb9149
SSDEEP 12288:DyPz5L8Z8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:uzyajzABgioiNV99L5S1fd0b
TLSH
T11D55024773A560FDE1368139C8615A06F3B27C724720AFAF43A406761F77AE09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3a021201dde16424bc19e30b9c8eb85ba405bd85b3f961f326f1aa0966ca8a35
MD5 5f50730f4e17bed8c25e9df4f1b4618d
SHA1 c3b76fa263b5e7123ff5f3e11764467d405c7018
SHA512 371bff4df8da51f35875224e12a5d8e0905a696258b299d6606b5855af1475546563dbdb92b01d97ef5bd87ffa541d0c50846ec7d77b62caa24f0b43b281aea0
SSDEEP 24576:+THaLl3z0zDcjzABgioiNV99L5S1fd0b:+T6Llj5jzQgilV995S1V0
TLSH
T11A650195B3904CF8ED67813EC855990AE1F27C6A0760DA5F43E4362B5F337A04C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b9141f35be7493d7cec5091a8b1df3aaf413204a03c57e63412109f15ce14503
MD5 6cd68c367272ffeaf4b2ea3f1121c077
SHA1 4979110aba8a9a9fcc4c556aadb39ea1f276cb8e
SHA512 66bebd96ee997045591b701c3d50d26d16928ce14c21189f3080213c4d77613e13ff6c008798acd35a2dbfe70f0d53d83aece8557673b31a2fd044c92a5e6db2
SSDEEP 24576:937d9CHKy7GZojzABgioiNV99L5S1fd0b:d7d9CHKyaSjzQgilV995S1V0
TLSH
T10575CF90F3E414E8F1B78A35C9759512DAB67C9A1B31DE8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4c214ded26c17d2134b10af4fde9b38ebf3da7d113d9b602903e03e4b9177932
MD5 1ad471d7e9bf1c12bffcad91c4421aa3
SHA1 d46a370f60957442643d3cc4b2ab8c03332a9c2f
SHA512 98b3e816e0cb7c52526beab1115002a472192810070165a0a38bab0242f6e61192d6a9e0fc24c46e706a18b600b8d8e05a7855479a6058268af0a76d0ccca41d
SSDEEP 12288:S38jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:SsjzABgioiNV99L5S1fd0b
TLSH
T1314523C79269C8CFF32048B9D454F54FF0B36CE596403AAFC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fd53e49dae940e2a5ce0698ec9f66e3fdf9e0bdc9bb82af64e2a091bdbda53f5
MD5 1dd4e87b35bc96cc8a032b0f9d281907
SHA1 e86b077a1f15d831abc2290bbe085184bd7608a4
SHA512 3adf2fa83222ac821eddf2490083d56079c7466fbafa8192be3f299b6ad588c5259c3e2658c6adf41639e070ae0fbcf48adc9f7c8b09cfba2900c1eaf631565e
SSDEEP 12288:C58jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:C6jzABgioiNV99L5S1fd0b
TLSH
T17B4523CB9268C8CFF33444B9D494E50FF0B36DA596003B9FC3E604265EFADA1891569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 716087ae7e901172862ba240fb89e1c21f72f44461120b5c56e93f6c35dec567
MD5 6bb34271242f7474a1734cac05abdfe2
SHA1 abc50e361b9719cfa472b13aa44cb0794c56d884
SHA512 821c9c6773c4e1074cfee38c7d7493e92b3506b13bf07342f237f461088402537bd60e6b6ed2b178d7e377a6187ff4797014fb970f5062e921d769598ee7b427
SSDEEP 12288:cE8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:chjzABgioiNV99L5S1fd0b
TLSH
T1584523CB9269C8CFF32008B9D454B54FF0B36DE696403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 298b307e7ccfcb481212d49e88851fe8708198b5764833f01e6d459e40d136ec
MD5 eaa482c0281f3d7080523e4be1e6bfd1
SHA1 4a7de0757c7bdc858999c5abe8c6c88cbaeba5d5
SHA512 58d740abc1d3474ccbcaa3c9cb69be44732d46264376448a17cbd898df68dd5834319dfe4d1ddbc2394dc861134d4d755dc302938e6269e099bbe197e93c5a43
SSDEEP 12288:mi8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:mrjzABgioiNV99L5S1fd0b
TLSH
T1B54523CB9269C8CFF32008B9D454B54FF0B36DE696403BDFC3E604265EBADA0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6ab4e11ed5aef5afbe397d297faa561b8ec933cf5b48a569e691c60135e5d580
MD5 5b54f70988798b2b9bd29de00308d6b5
SHA1 804b009d06bcb7734bc2e7c72c1150e1d07af908
SHA512 66604620164a30498b2b4c277cb6d8cfa91e80d1b3108748af24a520d971280e646f5a20258c06c4447e0c06928bd3ba1afe78eaf2393e2ce3572590628ebbe8
SSDEEP 12288:QNsfS8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:x7jzABgioiNV99L5S1fd0b
TLSH
T16355F04AD29881D9E16E5179C7559A06F3733C6583E0A7CB83D0F43E0F76A908DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0df0dabf4aebfe85afc218e29b96d05b299b258044a8c42a74ab1a3a1e382978
MD5 2f900f7e85af82abebae9fe3b327e55f
SHA1 1e6b82421174c13a7d5b5dd2447a9902ce56095a
SHA512 8152765d864a7e80c013c66f38971597ae301ca3fa6ab3478002e75278cfc280859c3728b4361068511bf5c176c3bcc2e444a33586125ecb35d4e87cc104f557
SSDEEP 12288:UD8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:UIjzABgioiNV99L5S1fd0b
TLSH
T10045228B93ACC88FF2755974D464E41EB0B77DB48B00BA9FC391042A5DB9DE1CD24A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 5e78584192ab444968a84e77b55c62ec5d6a067af89cee231d0a534474b20c56
MD5 93a73062bc36ff79d4fde2d52fec5d1c
SHA1 dba8b7fff306162fbe869167741a7dfc1b938c5d
SHA512 f855682485e050221f3773b717e721341d3c6d822fce9178a4a5e273ef30d9f20443a3867499201d909c843efa96f7f9578c3dc883e37d8bd0c06de93b5a5674
SSDEEP 49152:5a0h2GEkuAe73q3pp46zwwQyjzQgilV995S1V0:5a0hNYG4JwZjI
TLSH
T10485AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 ceaf29756c45c4cebba5750036a0076f753b61c047022373d22a52481936a25b
MD5 24d353105e2086e9ccc5cf9a7ddb9d19
SHA1 c497e83afd28eff35c633a5b767c7fcebe2c7c69
SHA512 1bf6cc79e6ff00291fc8011afc9b85fcd4bbff17b76cf9d5ee8d81fb857c1d6bec1dafb3f7ab3058ea32a6000a18842604fded8a3e0479ad9105226b02b62ef0
SSDEEP 12288:zhbHjfXB8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:zhbHjPyjzABgioiNV99L5S1fd0b
TLSH
T1A15501AE12AC10CAF271A17DD591950BE272BC651711A7EF83D2817A4F3BEE44C35F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2faed0d4c6180f5cec332c3dacbe68e471442dfe04c4a7d7056b5986ff2a9c19
MD5 aece0288148f63d6d0ce120c2226dcdd
SHA1 ac8b246242d68ad63bf12229037198c275f7c925
SHA512 009705eba6eed0a51d92e9aafec000ed6b93fc251bcf87847795f48586124d160edbd3ef8c309f69acd9e5ba7b1504a5cb286b2124ddc3d16a19ded319863677
SSDEEP 24576:Z3YgnJcRTk4yti+R5dBR/djzABgioiNV99L5S1fd0b:ZIgnaTk46pBR/djzQgilV995S1V0
TLSH
T15345BF2EF2B910B9D4A6D136850147B5FB71782D1F209ACB0170C538AF1AEE89E35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 7c5004f6e05456250bc0187e5dcd593b61375fea07ff41e362a315d8a93da752
MD5 9846573cf6472276c31c868f47735c2e
SHA1 8ad08fedabb42e7ccc43107958b17ac83f4f1365
SHA512 93c5362de9a387e80b1fc34e13e7660a4c1640c5ddf9b588619bcb0327d26a7a119fd7ddef417958f3e49f101c8de22a7e7f6c9b89ffa6206bdebec9f3812193
SSDEEP 12288:V/8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:VEjzABgioiNV99L5S1fd0b
TLSH
T19A4523CB9258C88FF33149B9D454E90FB0B36DA057103BEFC2E604265EBADE18935697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 2e4b9466c87aadf7d464181528b5295e52be0049fa7cadff3fbec8453ad82005
MD5 177c43bdaba8cdf09367989084355da9
SHA1 477790e1d792da7db23b72731e9280805ed853f0
SHA512 f71c631a594f8257f99ed113ffcc0a44a63e03e2e7bc5dbc220324a295a2ac83f1f2fac1a04a240ebb50e08b0b42c5097847621e93c2b7ea07602dfb80de7133
SSDEEP 12288:fOb9A4LWOsvAYFT+8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:gpL3UTHjzABgioiNV99L5S1fd0b
TLSH
T1B4750155E7A440F9E977813CC8A29917E2B2789D0320F7DF43A84A661F637E14E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 1dfd198504a76c5086523d8bca38106cb3c71bb8671df85d938e10040e857f36
MD5 209dfdb1e33ccfc5bb342695eafdd7b0
SHA1 d81b73f067510ca0dc308cdac7004c9c1c69cdb7
SHA512 dcb97ab8ac5f61df64024423a97ff466597c766dfbfa0382128c3f5e3fb4dd2b36d903338960abc16a5d2c98e1435f8afcc5452f174389a22a634c03b470b0a3
SSDEEP 12288:5pFtpO68jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:5OzjzABgioiNV99L5S1fd0b
TLSH
T11F55015A32EC40D9E275913DC992920EE3B2BCA5071167EF42D0407E5FA7EF49C3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a8d6c84a64b36c993c68e696593f7436408cf7256245d1dc9f96de36239c52ca
MD5 9a5ff96f4a954c1161281cd2e43f8e07
SHA1 c7691dc0135d07aa04d4d3b979d39a4f47bbc0b0
SHA512 890635ba3fd8cba0f8edefd12f9c91477e0e7003dd7795483d5088a654dff4d9b8ebffb8d7342cd2c15b575bb82ea3d1ee8323632d87e3b58a692849bf069c59
SSDEEP 24576:f7NM9YqZqmWMUkPjZM48Mv6bEhs4jzABgioiNV99L5S1fd0b:f7cBWMpPjN8DbEhVjzQgilV995S1V0
TLSH
T15665AE2E6BEC81D5D576D13DC9A28206F2F2B4611B318ACF5162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 33b0b38b6875f3ef9eb39221f1488be1d90ca4c5f8589b782d4a061f8d9b4fc8
MD5 5981ae120def9276af4a4803bc64dd16
SHA1 9e4e4cc374ec3358a50f6242d5c66ef78eebb292
SHA512 868ea80e57fc1da287731f3ba26cab7e0ff218dcafe34f35cf89d639e159df3da9e448f152aadfb4524809a8cebeb99feaad1ca434b7cee356dadf9210d74fd3
SSDEEP 49152:xF2YuHNETovAvNYf8kmYjzQgilV995S1V0:06BCf8kzjI
TLSH
T122858E2A27EDC0A4E0BBD27D85B6D146F9B2B8511B3056CF4255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ccba0dd80169cb00606781b9b737e1be94d20803de68af4e48ef5e1f5acb0958
MD5 b7f322a886c4c65e82370e3b5c73c238
SHA1 a99e5eca2fe31fabb7d14f6e90024bfd98bc3e5c
SHA512 0fb4b6e97a8baf37cd3f344aae409018df8272a56d4318dc55710c3d4e1ee5545a6b036c4be8818d2679af2600241662dfa7f66aedff49c97d02d850d7a91618
SSDEEP 24576:TAFs06+Omlf3NXEbTofjzABgioiNV99L5S1fd0b:cFs060lVXuSjzQgilV995S1V0
TLSH
T17265AF2F62EC00D5D07ED17D8997C91AF6B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 e001cc08d91abc828260310d56b521fdcd8ede5d68fb3720ebabfe9f6e6da357
MD5 0cb8f6dcf27630ddf1cf59b785a08cdd
SHA1 181e9937cb6f198528c1c44469078c4fcf73b07b
SHA512 c91e0694ad25e3e7ff1da287b56a192c1ed2867a21ff094023c1c5544977fc4466b70a916f2524b6574626cf9ede5d873037f2f94506bb42fbf187efe3d45df8
SSDEEP 12288:rCJnJ5D3VkrDzxz8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:mJnJ5D3WXSjzABgioiNV99L5S1fd0b
TLSH
T1E075E02DD2A810E8E0B7C274815A6B46FE72387D2F226ECB54B4D5353F12EE09979F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 91582bb9b9bc7f047c8aa5d517cac8e6ce399b79ce611f2ae17c210a0a4348f4
MD5 d82d2195d10de5b2d300b174c5c4ea86
SHA1 c08f2f21f5edf01f7cdda5affdfdefbab2fd7497
SHA512 99fcd51a94498ffa5b20c2c0689c7cf8291e5411fc1aa4b02194995fb10a75785f43d54ff25f656a941033dfa51bee800b3f45f3dc29cc4362b4463c152232cc
SSDEEP 49152:Vg06DIKdwc+eQnSt65aVcjzQgilV995S1V0:u2jI
TLSH
T1AF956C16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 10e2ef2c9393ce62b8b4e0fd02e2ed85917326f85d3eaac4bc08366c10a74ac5
MD5 b875d5eff4abd03aee04d292698f2455
SHA1 a4938329b7e6d54b7a11b68c48ffb4726981bb80
SHA512 a2bec4add15d62d307b35371700c8c3367580d6494e8c68ff2bbb52b6448b852f6ff92d5a2f181999bc3037bce695d15c2d7cdc1f7da62c2d7fd128f85ca7086
SSDEEP 12288:jEP3RnI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:on1jzABgioiNV99L5S1fd0b
TLSH
T12755029E67AC90DAE236907DC490850AE3B2F47057113BEF82E1813E4E77EE55D39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 39e43c40743977cd6238ee14d1a8ab29ca7653dcc2b51445409026452dcbe74b
MD5 01952c2202a88da4d097b15fc2e45131
SHA1 da5958cc65900337e7b9ce650ce7f9b613c9dcc2
SHA512 dce32611ebb90a89ac9f5210b220a96b1a0d1788d667d9dc8e1c691b1a3f0b58f5f6a48c623ef2ef3a59013b4bebaa41a3dd0afd20fa0db978e518eccba92da4
SSDEEP 12288:Njky48jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:NIyFjzABgioiNV99L5S1fd0b
TLSH
T1DA55124A6398C4C9F2750538D962919AA972BC705B2077DF82D0A63F6F76FE09C30B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 78c3c077c97b59661e6fde3248172dcf22e1c7504893b9aa4579966bb2460f13
MD5 d9b334c1e00cf61cdfd23fcbc145f077
SHA1 7ed3b640237940ef1dd2c7cb82608dcd2e8584ef
SHA512 a94b481ac46f5b393a0d24fde0f9a622adb1dbf79e1a5fcbbf360b903cc290a83dc96f8eefa64775ced4a1cd650880c313750b0fd69ed1466b9cb5c2408ce300
SSDEEP 12288:xyq8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:gDjzABgioiNV99L5S1fd0b
TLSH
T1C745238E5269C8CEF33145B8D464A94FB0B37CB557103AEFC2E144368EBADE18535A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 f0443bc1284a6c302ee41b85b5fe5ff2c69916f1405462bd072b24d9ea51abbc
MD5 4f07ab94ca7a3299255fc8a6413ea404
SHA1 49cb571beb8b9464bc357c23f3b9c794f0db4c28
SHA512 f7635e9630452beb4a1bf9318c09d392da5594e03a112b345a1ebd412ff0e0fd8a1a549d09e1545955c9f1b448730b2fa6ef254df6762091a79f5e660668fe34
SSDEEP 24576:zQ9MxZKdcz9dw3wjzABgioiNV99L5S1fd0b:zVKZwjzQgilV995S1V0
TLSH
T109557C2DABE9098AE177D275D4A250C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b1603145cfc397910cb86a4a1ba61358c741440ca74c5b0d95818e4da938c32a
MD5 7fffc1c18836cc00ded827f047f5d03f
SHA1 13708926c6c95931a2c8f5cb8dece6bac7266ce0
SHA512 c3f987549114840ce581d8cae8a7c9b8ebd6e649e619502e9809d0d7ff605432d7d296f231c77bc361c2e29ae5c9abd8b7598eb08ff906a9dbee37580609d7f8
SSDEEP 12288:xyoKo2JRple9pU8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:xyocDApRjzABgioiNV99L5S1fd0b
TLSH
T1B565E05FB76D80D2E172813CC8848645E7B3B4705B6267CB9291C33E4E67AE8BD34B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9c957e78096fe90c86c9302a41fc8c3e7420458fe05c5984c14620c6d109acf0
MD5 1e8bd832fd433fc608acb63111315ca3
SHA1 82bcec3b260a7099a48288378e7b1dc457e1d33d
SHA512 edcd3bd59ea842a5fe14a7cbfca4062483d36d1f0192436186dc9620739c5c850d42c370003b93e8513ce1885edd3a8442ced5c7ba96c1a34694c02036fc435e
SSDEEP 49152:EWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKRjzQgilV995S1V0:u0zuNIHjI
TLSH
T1B2A57B3DA2BC00A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 334a48b6a1f199b1ae55b0b2cd0fdcc11a4dc715e3b1ff836bc652a4cdb1fede
MD5 baca7a7131025ca47c589fcb4d2ded1e
SHA1 6ced3ede5979cab83efbdce5aa26d74b75adb4ff
SHA512 6e160338a458aaf72c3175f8f59ea75bb42b9d56cc4f11c476e8c0fc1b400ddca2d98205ec1729cb1b46e0588966af3dc0e096033498737100c32d8ab7ac730b
SSDEEP 24576:H1QT7EcpfxR+N5AWAz3ooiYtjMqb1jzABgioiNV99L5S1fd0b:6TDxR+N5YzTfjMojzQgilV995S1V0
TLSH
T1CE55B02EA7F845E9D17EC5789A23C506FA727821033193CF42A0C17E1E6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/640-516-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/640-324-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/696-332-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/696-278-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/696-411-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/948-246-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/948-316-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/1160-519-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1160-415-0x000000000BAB0000-0x000000000BAB8000-memory.dmp

Download

memory/1160-375-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1160-353-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1160-337-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1160-333-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1656-27-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1656-2-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/1656-8-0x00000000006F0000-0x0000000000757000-memory.dmp

Download

memory/1656-0-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1868-260-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1868-257-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/1868-319-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/1868-251-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2040-34-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2040-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2040-233-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2040-43-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2152-518-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2152-328-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2540-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2540-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2540-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2540-58-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2540-69-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2792-26-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2792-28-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2792-25-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/2792-18-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/2792-231-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/3300-282-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3300-377-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3380-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3380-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3508-499-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3508-320-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3764-247-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3764-242-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3808-417-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3808-298-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3808-297-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/3808-304-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3920-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3920-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3920-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3920-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4148-292-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4148-285-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4148-286-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/4148-410-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4192-275-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4192-327-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4256-317-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4316-435-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-448-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-451-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-452-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-453-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-454-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-455-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-456-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-419-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-420-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-421-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-422-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-423-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-424-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-426-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-432-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-434-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-433-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-431-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-430-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-457-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-437-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-440-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-439-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-438-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-450-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-449-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-458-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-447-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-446-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-445-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-444-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-443-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-442-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-441-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-436-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-429-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-428-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-427-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-425-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-460-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4316-459-0x0000028E74050000-0x0000028E74060000-memory.dmp

Download

memory/4508-270-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4508-265-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/4508-272-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4508-323-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4680-204-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4680-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4700-418-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4700-308-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5080-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5080-72-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5080-78-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5080-235-0x0000000140000000-0x000000014020E000-memory.dmp

Download