d12bd3e8945f588dc1b20024b6274505420583a2edc989e9690ff3a8719a55db

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Size 1.4MB
Sample261102-hbdyvsed28
SHA256 d12bd3e8945f588dc1b20024b6274505420583a2edc989e9690ff3a8719a55db
MD5 dc0f69a0a094a830947fcd4d1cfdfa88
SHA1 507c956adaf5068203b8db8c130a7b2a9f29e1df
SHA512 05aab2e9e5b9b4c450d3149be95b63a0cf0ac8afafcd471a16d2994c075767d5c289c166a8785b9263336f11844fce03cf9310ee14b135ec2793dde38e49c2a8
SSDEEP 24576:0LVSCxkmgXe4i7ojhsP5Lgrk1TWb4AN5:jCxkpe30jaNf1TWbdz
TLSH
T110650100B9D1C472D1A2117258B4CBBAD97EBC210B244AEF63D45B7E8F346D19B70A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4980	alg.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
2228	elevation_service.exe
4584	elevation_service.exe
2100	maintenanceservice.exe
2092	OSE.EXE
4724	fxssvc.exe
2780	msdtc.exe
3948	PerceptionSimulationService.exe
224	perfhost.exe
1208	locator.exe
1060	SensorDataService.exe
4316	snmptrap.exe
4180	spectrum.exe
4424	ssh-agent.exe
3216	TieringEngineService.exe
4244	AgentService.exe
4312	vds.exe
4648	vssvc.exe
5084	wbengine.exe
2520	WmiApSrv.exe
4224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2834c316c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d964dc51946add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac3cf451946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eec0b450946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd22b750946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc47fc50946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074a9fe50946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083e68052946add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1372	DiagnosticsHub.StandardCollector.Service.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
1372	DiagnosticsHub.StandardCollector.Service.exe
2228	elevation_service.exe
2228	elevation_service.exe
2228	elevation_service.exe
2228	elevation_service.exe
2228	elevation_service.exe
2228	elevation_service.exe
2228	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1592	2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	1372	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	2228	elevation_service.exe
Token: SeAuditPrivilege	4724	fxssvc.exe
Token: SeRestorePrivilege	3216	TieringEngineService.exe
Token: SeManageVolumePrivilege	3216	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4244	AgentService.exe
Token: SeBackupPrivilege	4648	vssvc.exe
Token: SeRestorePrivilege	4648	vssvc.exe
Token: SeAuditPrivilege	4648	vssvc.exe
Token: SeBackupPrivilege	5084	wbengine.exe
Token: SeRestorePrivilege	5084	wbengine.exe
Token: SeSecurityPrivilege	5084	wbengine.exe
Token: 33	4224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe
Token: SeDebugPrivilege	2228	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 4992	4224	SearchIndexer.exe	123
PID 4224 wrote to memory of 3408	4224	SearchIndexer.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_dc0f69a0a094a830947fcd4d1cfdfa88_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4980

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4584

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2780

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1060

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4316

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4180

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4992
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a15a07ffae64e1461c399e9d44e658f4b2e2f69292f6f48dfa536ebdce7ef0f2
MD5 92cae50e3c004a002f8ccc2adef99716
SHA1 5c7210a976cda1b04394fd00fc8cf5270937c299
SHA512 26a9663c2a375b272e6a00783036a7577d9d5e76508b8161a2d6be6a97804e8df4b9f127467afc9c25ac595b043af77cd71aba80e1d21683f8ea5c93f1e4b26c
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn7e30jaNf1TWbdz:G3q6HjBaU023W
TLSH
T19AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 7052ccf19b01ff6ab063601c6b18b56d1e9858a59cd8732d819883f8f3a0c919
MD5 5b7d17f6eb1079669f4b0f87567b621e
SHA1 3f0fce8910d829abb8c32fecca058fae77b5a5ff
SHA512 ef9560c19a3b65da0fb52749834ad795ef06e48a0abded359900d25eeb989ac37a3d79f16a96823c7a287663275f9772b8769ed8e43e82b7e1a441e737c2440a
SSDEEP 24576:JXYfDtczAPgXe4i7ojhsP5Lgrk1TWb4AN5:stcZe30jaNf1TWbdz
TLSH
T11C65F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 059833d00696c4f232ec6ab3152c5316d075b2a4c7385b2976efce03f6fd4eba
MD5 0a2d6015158763ad0f558c13b39bbb5f
SHA1 2f7ac0c6da187ec76074a151127b48d9c482176a
SHA512 1801d592c63d210c155a89b8e047400c7d599761dbbc852ec6b640bd75bcba2d38ec2d928d8bdcbd068b075a582a1b561a897b2e0fa82ce31e6adb95e668ef5d
SSDEEP 24576:B0Le5ji0hmxirM8gXe4i7ojhsP5Lgrk1TWb4AN5:BPji0AcAe30jaNf1TWbdz
TLSH
T1D485AE26F6748775D073C0B9C5D2A78AED71308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3199e7ac1395ae60373676429ed301d73a790b294d1825481819b88e884af33c
MD5 f7ce97fe6e5a827ee39a93253ff8f95b
SHA1 3e210084dfec502810340f8030d9aded4e31a66c
SHA512 4a3fc95933838e9a057acc9182664c5bfaa5deddba0d434d7d801a95a5237a5866ab5b931f10824ad96f9a6a35748c50448b711738502463c7b611f17f795f83
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyumgXe4i7ojhsP5Lgrk1TWb4AN5://ezSC6vUzPvxHjyce30jaNf1TWbdz
TLSH
T1DB756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af5564b4ec6fdb8fe50f821cd8313ff34fefaad5cf7d8d12dc677e54ae850a48
MD5 7550327e602e5c038a58c006fc240dc9
SHA1 efaab41a9b7f75cd751c245bb46478bcc6f93474
SHA512 7f242916064a4917349d67934daf49a9839905e07e5183c22806671613397811073fd27873739cd9919fc81afa19a4ac99937bfba0646c2a1047ffe50d5b77fd
SSDEEP 24576:6VbqPb88hv/l+6TgXe4i7ojhsP5Lgrk1TWb4AN5:6VO88hXl+fe30jaNf1TWbdz
TLSH
T1E7559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c8d70ddbab3c2a385a2150a01e36a4e07981bb082b6d596eacca2739ff9924da
MD5 99f38c77941182e11d63b1a09dc7d2ce
SHA1 0f07791c3c61d8cb19d339ddfef55658e6516329
SHA512 debb1d1bf0d53e0b4bfd3e6225d81cd6854a1ba95d8a8c95ed1565d44ac947f64777656ea9f413a16d669da3ee8d6437337e0a040e2284020f765a22e6eaac28
SSDEEP 12288:fRD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:fRggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13D4523929F5449C6E38BC3F4A0F7CB91E5E11EC071444E6B47E0FE9318BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 59a2ca0628160f1e21c66cc1b4c6da8415f5e9907c52480d4dab5fdc2a3057ad
MD5 b98b2d857b78aaaa88cf79c4883854d3
SHA1 ed9f96afd58696092232bb4087d22822fb318b14
SHA512 8085452d4a3dc4e014fa9ad33695d3cb9d835ca9dd9506dcbd8176fd4c3fdcfdaca711b8a7a976f6112cd7f7df2540de17de24af0e7274a98e175925bfb14965
SSDEEP 12288:jeBNUbTVO86UC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jJIUbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12465CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 88c37478e5af321e544f2f86a78fac4dc24d411da0ea19af4e5bb29f84a39875
MD5 a6120c0c67d179275ee5a87594f8dfbb
SHA1 622b22152e81c4c6b4d7aa88541e25c161076729
SHA512 ee7959aae5639f04384f40aee824f6db13b9c55ea7ba7e31f15d05ae0c9daeb7f20a970823897cc859e418551324675c6990493e564d5d143b5b7abef575bb89
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH+:OQvGAdlCEL8c/yRNw5C5U023W
TLSH
T1A1267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1d85a4da7cc2823584323ed583ef92be78cb12ce35ae789c9b55fa03b6b9b936
MD5 fe380b2a88aa83fde72e32d426e7caa9
SHA1 f26cb44d284ad523ce6447879c1c9ae7193eb5df
SHA512 974b405c13396f8ba7f2b8ef84ea860143cab42ef8504fd2fa4700eb3f553466e358fe32b6bc1e551511d8a391a838efb62d5ee8c2b7f19bd8048c11c7ba50ce
SSDEEP 24576:2dewsAjFgXe4i7ojhsP5Lgrk1TWb4AN5:+ljQe30jaNf1TWbdz
TLSH
T1E175E031FE74E032C3BB0DB21B76C716547C6A604B511AC3E3E89E9E59342D22776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 42001e4ad63f6d96fc146c56eb635a3c85079750b1f924faa0183a746ce2cc4c
MD5 4aa3b4e8151ffd46d5ac102c59b46183
SHA1 881c1e3ac04095761046d99ccef72f31125553f7
SHA512 b1ce93f5666bc26c1280463fd3b9a3e36fe94b3a83def725d3ff497c098062e8415b35f4235451b12919dcea1c6fbfda0629ccf09f450eb8c57f275d1c3c8d03
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4p4W:UUEtQevvqc2W1cpV2EI32I4W
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ae0b1fb4effe10810196894942a64a596048098edf2d89b67c77c522cb47ea5d
MD5 4a4e7463cef42371bc907be9633a41e7
SHA1 fda4660900547526ef3153a1ffb857697183f201
SHA512 ff10d525fd2518a1bd8b6a3426dc95d897773218086d92f8bff12fa7a26592d912c6be913f35300bfc78f11149b53b5f7128c0ffb1b1c8b90a4be76e4394a66f
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/zwe30jaNf1TWbdz:ioqtVjnm1U023W
TLSH
T10DD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dc3cba4e6480828dfc1cc9ace1bc1148054cee0e8b6b08980062e361ea8b3563
MD5 8f63f0bfc3bab8df21de61d363902c4c
SHA1 b01083464b96d56b9daeab5bf12565b1a3231d02
SHA512 e0bac115446a85982abe3d0e7272a8498a570ee0c20cb57f8084323448dcfe03c51d99aee65aa51f6bb701f88a77868d9b5b6ae87e08ab408fd2e42e45986d05
SSDEEP 24576:dAhGLJIFoiwtA5l7S53CgXe4i7ojhsP5Lgrk1TWb4AN5:dAMyFoiq5Fe30jaNf1TWbdz
TLSH
T104359D81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2922b03b626cd76af8919a84b3ff391ac735b3766afcea1b11dd905796f60fcc
MD5 f9993830507844eed22cb5e31acc782f
SHA1 989f67f9c134bb7755c9bac70cd99ca5c1267e26
SHA512 cf6753539f386a9e886331db2d41df9f735ac68cfb5b0f9a24abcb6d4192ff83100230eedb074cea2356e9d558429c727b204dc66f7c733ba958d267798fec60
SSDEEP 12288:Imw5HEjsChNVBFgl0WDm+CZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:lwuoOWBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DE65F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 58c7c17a3d67a189bbc24c7e848290d2691d7a53884b05acc552b916f5562f45
MD5 2fc322bbc04fe59ae254eeee29bc78de
SHA1 92d2abbc98841f7b3e4f25586ee4e6f484d383c4
SHA512 037bb586ce4aa4045639a7fd4d5f5ced0b8ed2ff44552cdd929575a11e341173666a62be5c6bafe0aee2073155d38d161e12d0eec2c2fd37e57a38f95b0848ce
SSDEEP 12288:MBZ1IyU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aZukgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11355129637E420F9E2978278D4F28741E7B23C82237547CF02A096A61F76DD65E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 174cc638c936bf30e87238fc2ab1c325b1ab7a89ec9902411d4e9b9e8abf1b77
MD5 167a9d89e9d4ea70f076d55d3930e4c0
SHA1 fdfc771c07298de2e37972deb2c06087759e771b
SHA512 d7560fb1880b8254edb076fc8e1b0392d05ea2d74f6484043f747d274081ffa8d494c41ea228f905aefd89e7e18c38b410d529510a2b5ed2d72657b4e56c9c63
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:vQRQyi36YOcPQLvw2gAf+PN3eU023W
TLSH
T1C0667C03F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4980c38dfe7d2ab239f085948c8b0c7e14c18536d303791a3ecf29af018e9ba5
MD5 90839d971c7088ca69aa3e1dbdec1324
SHA1 a47e719de92e12298d39ea8d8bf28493c35f26c7
SHA512 01ddcc105f0d75f20ad66f2f88e907518f57855db9c633c28e6b281b8e8349801c2f063664e0c8f372d5f38841d13605bb2b2794c0302fa4a837f7bc98f736ea
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:YQRQyi36YOcPQLvw2gAf+PN3eU023W
TLSH
T1C9667C03F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 41f7fe12a0505d1f53318ec4f9869f48e61b9e099c512a460eeaa4ebbe514328
MD5 3267e14b49ee65c213f342f2c09f7c36
SHA1 be8c9009598a35d8f876505da30de111aa55e2e5
SHA512 7ff723bb673500d1c22f01fdb890510f09056ca6bcf64fcdf524c2d40a4b81ad82053b58d84f6ec11b3b208b48f53ea540c0c5769dbec917133741214f466b11
SSDEEP 49152:h68Qg55nhheWu7PNU3/Ae30jaNf1TWbdz:fthWRc/AU023W
TLSH
T16EB54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0bb1bc79f1e620f22d993f7d93009839f9a8535fcbfbd51dd2309c7fe02abcc7
MD5 b15454b53f7dcff0408f0f37a5a4ccda
SHA1 2eaadf98ec1432467da044e0f8d5270163ce0904
SHA512 e1148383aae8c25ba9cd931fd49823b52638d63307df2f52f878018033b5b8bec60fb0437e7e696e77a8ba0ad7d981d5f3f4e8ba7991a7da6039a5268387f4ab
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:4y5112gYy5azzVvL69nLKnhZnU023W
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 abc0cebcf05430bbb3f0355c91e5088dd4d99e820b8a2643fd017689a9bec482
MD5 d3756429f4cebece706788b604271b9e
SHA1 3f400e56a3d2a9dc81bf735500f3476c1c483810
SHA512 8f93ff0f4d422512cb860047df954648589b9d0d830a33a0152d81269ef21eae4fbc9ea44a55295ece26be359a0545f0584a623c60fe370f999ab4c57381aed8
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl2e30jaNf1TWbdz:Nu6JmVxd2d2U023W
TLSH
T1E4D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e0fa9664198d5dffa5ee2d79d71ab4b61af39fa95b10abbe0c78a6a710d9195a
MD5 61fe20e55db1cf3c07eb4d83b7ac10b7
SHA1 ff9e03a0738f3dc898296b5ee3ab0dc837917fa5
SHA512 37222543e9e531e2217e46dde641065ccd8f5a904dfcda47f82371780380f65b5174b416d388f7e7e3144e070360dfa6606ca9d8b5e2022e914301417019fb80
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xie30jaNf1TWbdz:4mifPbR1U023W
TLSH
T1B7B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ec57acd0e265103539b33443ee01653bcb43b5e63c227daf65f7a704118edeed
MD5 a0ea6169ec1753b9b768ff7e030ae1e1
SHA1 a47b2eb45aac63ae8f69fed2f2108fdfc5780472
SHA512 fbeb6e2000da8f23d6b9a51cafc0dbadcd5fb9ce98244faa6df833ac4b0411a264b3dbe6e20d14b212c2937420b132e78e4bcaf444983f4480cf3d9795dad5c9
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHqLe30jaNf1TWbdz:J5dKTi61LU023W
TLSH
T1F9C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8fb608bf8c467e2b190e9e77da01dd2951fd80f4a811e0262e92dd22d0a74ad8
MD5 23919acb04a0bd44942b05f9552ed8d2
SHA1 05010826ec342bc1c7fff84035e33e35bac800a0
SHA512 640b4a28667b772c7efefcea6d5264f468761cb217a199947b05ae2e9d69a4452b13c5090c1beb24985d2bacee7f2431fcec5f58c8b218c50cba063bbc0dc338
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wGe30jaNf1TWbdz:QX2iyphhU023W
TLSH
T16795BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bfbb8453e5d0fac20794d884a45fb9b8921d14060ca0552c94551e2480e50d0f
MD5 d14a7a4f74a1d7ad5845087be044af2c
SHA1 ee528d82a2fc4ecedc0d0acc048a32d3f867ec31
SHA512 e07d799fa08e760fe01ce7173c2a621f9c91e5fdee98edd29091c9e3ea3891395d840bfe2dee97ef13f3be9d54aacaec39e42e87166e639001451a594f2d03e0
SSDEEP 12288:aL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CE452392AE5549C6E34BC3F0D0F787C1E5E11FC672444E6B17E0B95319BCCAA6AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1dad40d89e0dcdeeb4c35acd3184585bc4a0d2dd4f92162205f4840fdf29e120
MD5 26d2728e0983abe6c1e9c3b278b31ec0
SHA1 cf914b6b4e1a1bce4e91ba1f78fec39d8050a251
SHA512 3da87fddbbf668fd9e3e42728a12241e176f79191d96d85688dda4c6a022807b350c809dab95adbb9583a369fbeefbf8014dad2958c6d764b6a4c9f4471e1ed9
SSDEEP 12288:7Y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7ZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E6452392AE5549C6E34BC3F0D0F7C7C1E5A11FC672444E6B17E0F95319BCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6bb83cbc5b9f125a1120cceaeec6008b5d3183db8d64da317d6e1261cda48585
MD5 1d1ceb4a2d9143e39e092f8d5d7994be
SHA1 4c3a7b0c64d1748c0c2c69f2824d4f25748bb064
SHA512 924fd0658a31922f29c0e95e1033803b9d8e48fd177547a8dd9187881b39cb34495eca5e3dc99066273a84162efa12063a841956d0d2e8b7e1727d0aabb9e580
SSDEEP 12288:rq0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rjgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1ED452392AE5549C6E34BC3F0D0F787C1E9E11FC272444E6B57E0B95319BCC9A6AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 68d022b5168cde48f30511e9b64b9176ce7ff4afb228ec2141f8572d9636cec9
MD5 8bc0ef6286342cf786f59adab432d73c
SHA1 5ccd0420c680f787b52831ee9d9c860a02d414fa
SHA512 10c9875690526a6e663c335ea525477085bb0e230d39976576d7c9c86a419cd8dfd8a6030c18baa6328a30992efc64353e564929a55296b8dad56c6aefb77f2a
SSDEEP 12288:LVV0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D04523926F6505C6E18BC3F4C0F38791E6F13DC173114BAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 aacc8f2d2c4f680b860c44d3b392cc9092436903b6aa3e5aafbea85549ff8782
MD5 a69203e82614a985f2e6c572399fb004
SHA1 be8f96fd56d8624bd6da5dab59ba4d1c8980cdd5
SHA512 7773f3814c960f4f59a11c707c8401ccaeb66ff5377edc7edb4d57557aa2f79c9eff33cb5bd138eae95dd8248806c5ab6a84c1f564ef9f58fcc4782bc6e0f8ea
SSDEEP 12288:MN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T104452392AE5549C6E34BC3F0D0F787C1E9E11FC272444D6B57E0B9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 935b83fd4585c9711d60ff58aafb7a871df851044a01be9c51fca6704d6ca3b1
MD5 ed94a41aca81f224328a83107c4a3151
SHA1 ecd58ea6d8ceb52dc57ea37c25b785d7610b2660
SHA512 2079bba53a9e45d617818565cc27968b9b07ea8f1486cebe1bdfe7b0c6d6a88d9f947afb8202a8802b858874a0cc3751161fc00555c8fc5a152077f5059dbdfd
SSDEEP 12288:+s0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:+NgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T107452392AE5549C6E34BC3F0D0F7C7C1E5A11FC672444E6B17E0F95319BCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 266d3674e1cce7c1410809b222aa9fce058787880c3a22b1f78c387bcafbe014
MD5 d09ba277f0118877c939e782b652cd53
SHA1 14c286ae5e66c2246b3b2f338f7e932d6941e463
SHA512 52ed5e79a2ba9bfd9c5ab103488f9f93b8dc6482bc5f3f8f575d6dba380aba3d3b07f5f6551a978e809245144d205b9f458a98c3d96c0c296dbc73d6a2786c43
SSDEEP 12288:Qw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:QRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B1452392AE5509C6E34BC3F0D0E7C7D0E5E11FC272444E6F57E0F95319BCCAA6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b5d602396e575f9797bf0972ff68ca1400df901c323979a1e1e56ba3600a2bf2
MD5 66e65b4beb8fb1f57779087d5243874a
SHA1 7c965f10c8dd01d61f2af908af8950d65f2a0e8b
SHA512 c0ace3bf9b346d19ca1805b8542d3b1a8b1a62228da9d4bcfd0b5f58a16e68e7c1528609c7309090fc997b1e78f14dc6e4cd701831cba243993525c8bc166804
SSDEEP 24576:QZMSzFVSO5gXe4i7ojhsP5Lgrk1TWb4AN5:QZMSzfYe30jaNf1TWbdz
TLSH
T145650195B3900CF8ED67827DC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2d28f5399f57c074a4990f3678a213d94376dbc8ceaed129548a7ace90059f3e
MD5 b4ef8f84ba9a5f503c363975d8f02546
SHA1 ef5698ef7f30bf657cd0a1ab7c3430e61f09bbe3
SHA512 72a0292fb6b9f2ddaed3a4d80fe37adbc91e3c0e8fc7532e461174bf136d7a0d5314bd74dfe3542dfddc7b181f497caef2ceb82b821dd9beac81e86990a17e0e
SSDEEP 12288:hH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C5452392AE5549C6E34BC3F0D0E7C7C1E9E11FC672404E6B57E0B95319BCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a4c649422860121efc23732c1f2312140e6670a5bfb8e1cc69e1aae8ca728bb3
MD5 106a4efb902dad4dac71c369d0e73451
SHA1 671c94811a1f986e73d8bd6772350d705e0434dd
SHA512 f555a918c4e1d581523cff0f5cf367159e76142639d3a5c7be285027c7d1fa40063bb28b7cf5a912e12232fa00d13b298e754208d4b274a881036e4e7015f7d1
SSDEEP 12288:pT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T120452392AE5549C6E34BC3F0D0E7C7C1E9A11FC672404E6B57E0F95319BCCAA5AC84AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f60c4f60c5564729d292a548e0f8a56d2f8cfb8b72309d05daeee063f552838e
MD5 1614f3d889d19aa90d1a3f8e15a9121d
SHA1 730dc8de35f01600608f9a2eba001e1c746ef241
SHA512 e204a929974e09f45c0bb1ec807ce85866e92d4c12207428f07735962fcd21d19bd7971b692a498446a054a5f07c7fdc3f13a9ee32a3327bc2ee0c5aa3b10de6
SSDEEP 12288:FyPz5L8U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Mzy1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DA55025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E376E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a7f8439bdb93173a5f6054ae5f0e9815933b9373d580bdcc29fe979d6e9a782e
MD5 0bc9f28d1ac2788774a15e8ba04d3f98
SHA1 45a0bd217c753e6711394552b933fe65f290d1b2
SHA512 d78215e07ca0568f6d628b60fabe0f48f1969bc5da8294dafce9096ec5a85e0f31527d8d798b521d97ce75b16120f9ea9fc7002b484555308fd7f0a62eaec045
SSDEEP 12288:vH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140452392AE5549C6E34BC3F0D0E7C7C1E9E11FC672404E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 af300db356395b70b739cad18e7d9d1b0160dfe365f93a5bb55142a047d8f4ee
MD5 4a7bf0a7a1ac05792ec0d0603bab9e0a
SHA1 00e4f045defbe1c29b42f5718e2646f0c118feb5
SHA512 757a6027e84527824b99bce264cdf1bb52212883cccd22ad28dd14585bfd1ce4ac8caf9ca0861625831c2734bd1926bc07ace8d15571003bad47b87d9ed99831
SSDEEP 12288:9H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F7452392AE5549C6E34BC3F0D0E7C7C1E9E11FC672404E6B57E0B9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c0bd856919cd182bab0511c1a8724c5f741a3cacb86d86426c57bbe2f8e32320
MD5 af93851ac08680d0e868394b854f2eca
SHA1 36c5c61fa8f5c5544aee6d751f2c0ebd7a99b749
SHA512 a8d717e946ac6df7f3805c8991f18a73c6b1980ff5f0423f450ede5cd9556005d2c743f4dd29c8108b9c579e403ac9ff6ddfadce688a929cb0992ffe0695692c
SSDEEP 12288:eyPz5L8U0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Dzy1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A355025777A120E9D1678278C4E24B41F7B27C7217208EAF13A057732E376E19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 8b111595151efac22156eb129d8afdcad11b592055fb6c32917f1855a01a3c1e
MD5 56869647f270ddb7efa699accee5beb3
SHA1 8fb15887cf8707f63d2536eafaaa18bd7606b05d
SHA512 358ec7061d6c60b5f7b9ceb3f651c3d5217c86ac1d72263c3eca1ecd0b5f5045984a4ca88da05617f16a62ca3221783c2470af2e4935121ccda7c26ecc86bb6f
SSDEEP 24576:ITHaLl3z0zDzgXe4i7ojhsP5Lgrk1TWb4AN5:IT6Lljpe30jaNf1TWbdz
TLSH
T1A76502A5B3500CF8ED67827EC8A68A06D6B27C560760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d9c89e4440b578bed0a300dcce8a12646f7024be56f97b9871405c417993effe
MD5 a1f856ba0bc8d19ac7cb6388ab7d0a1b
SHA1 6da616475ac4b022f457591b61d5769536f72da3
SHA512 dd86e7dc78fa0d1ca28a1cd125e5cf79c72e3dbd6606a1bc80dae9bfe40620bd32d98f650e604dbc3a493b947f8b17b7dd016b2ec2eac6fa8004ab99deb29e44
SSDEEP 24576:Q37d9CHKy7GZ3gXe4i7ojhsP5Lgrk1TWb4AN5:a7d9CHKyaYe30jaNf1TWbdz
TLSH
T14775CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6e67ef1368252a7732cc2c7c14a77d6f5fcf91fb47d1c1354bfdbe5b4be2694d
MD5 7567268682a555b768658e7100944f75
SHA1 bf56a597b63ecc9254dd8ec4c09475d16e864007
SHA512 03206624a9854ecacf01c4282c24d6f9d144904878d1df991728eb0a04f2b8cb09edf9b41dd96dbb90a910469b82d5bcbef353e313937f6ccec4e962dcab0ff5
SSDEEP 12288:2K0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2DgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19D452391AE5549C6E34BC3F0D0F787C1E9E11FC272444E6B57E0B9531DBCCAA6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 669f0c862da42a88b16e16b39c46a2be426963096c3f1fdfc842588744f091e3
MD5 8083cc036e8fa6520ca82dea10e0849e
SHA1 55e466ef4164e1664ebdf86adfa3c54bcfe78ca1
SHA512 706c893ec3e706f601a5459bf2c0f0d2745f6105bb0dabc8b3e64634b7b3ff6945163a1e24cb5a93eb3d51dd4c1bb17a9970adb96737016d071e865166ed3aae
SSDEEP 12288:B00DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BVgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E64523A1AE5549C6E34BC3F0E0F7C7C1E9E11FC272444E6B57E0B95319BCCAA5A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6df95e222df7bb890ab58f9da2387bb3158b6f84a67366b2a3370d78ede4adc5
MD5 b4fa2d96f5408336c0eb34059a00d74a
SHA1 2f375443143640252306b63c433a2e5329fa283e
SHA512 7a08853dc5f18e8e387dfec683e8803ca0df4add30ec98824ae52d58741f8d627ee29f34ed56286fea5ed1e829373fe9d7dece9c0c3d2e438ee385b538fe8abe
SSDEEP 12288:aR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:aegXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T141452392AE5549C6E34BC3F0D0E7C7D0E9E11FC672404E6B57E0B9531DBCC9A6A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5f3b38c52a329fe6b44264a4b26a67aade91fab041b25618c47285524fc56b5e
MD5 685ce7b13cd1b2b423648b561ff434b7
SHA1 734cd01bad81c2fec605a1944121ccda0590dc48
SHA512 3d0e21c0b4e735d5351bb4abad537e43de8490f020cea97b64099cd4ecda04386d077667c7d7c9bffb30e12d53a03b07da0b8a55c268104358bddc4597484073
SSDEEP 12288:/H0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/UgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CA452392AE5549C6E34BC3F0D0E7C7C1E9E11FC672404E6B57E0B9531DBCCAA5A884AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ab555e136b63febd73bdd2335c58710e2ed60849d973c825f13ffe83ee1a933e
MD5 73e2a83a1fba9d8f361ba6e76848a7d0
SHA1 707764ead83954575cb41097f9d1b0d288e4a0ec
SHA512 3652575e0d5385148f031df28b08c046fed55d85cc038a5204cb76bdf654a0f2743a97e3fa4dc4c8c98656d8f0b25adde0436e4bc38d8ce886d2ee48d4601d1c
SSDEEP 12288:QNsf30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12855F05AD29802D8C05E92B4C3968A41F3733C9593E1C7CB53D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c3bb2e0ddecc76250f91c2763bcc38ab8ba488fd46e5006f7e30d83eae313fe6
MD5 c9ae7fd05a6f8511a255c316c144bb35
SHA1 9f09d9815c30cbfb7815de49b6449878230e443a
SHA512 bbccdf2e2b236cea43a32cca826c008b256747d1adf535ac1afcf01b5d8c97c65adb093c26df35a8a4f25063f257f17c9a96e9e7c75cbcc48371e3b8a1de39e9
SSDEEP 12288:QU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:Q1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EF4523629F5849C6F29BC3F090F7C760E5662FC07B008D9B52D0BA5319B8CD69EA851E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ed3f8a033bf96be897e3c22c4eb72d8b3da82cf0043d016fb2f060d358616069
MD5 062e693440d7345295b7acabef9ad212
SHA1 e15c4e1ad78490922a3b00f14eaed9ad836ccb6f
SHA512 c466b42d33e272c9bd3d3d3beaf464d5aa0f4fd2870ee1414b6579a3ae9ed613179b670ab588087b3dd6e78ca6dada9ce879d8e803ada8447ce48f4ff3252e82
SSDEEP 49152:8a0h2GEkuAe73q3pp46zwwQ6e30jaNf1TWbdz:8a0hNYG4Jw7U023W
TLSH
T17285AF1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 3d26133bfad175013b6b9f722936c4c4b270ea85e75c70ed9f4389668958f8af
MD5 866e1151a84d9f882df72297de5cb907
SHA1 3c579fcefe2a2d04410fcb79301baca6295eadc7
SHA512 3ddfa5b8b7e5f4d04f9601dddf76809b14623cc5f7bff503bb23ab7e5bf2844f98a75b92ff55056c7c0bfdbe705eda0ddc65520bf96ce7f978897ded2d0ee9ef
SSDEEP 12288:lhbHjfXA0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lhbHjPBgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A755127E2AAC10C9F276D2BC90E28646D371BC55271187EF13D0927A0F3AEE95D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c7b88ef4d7c43a3bc4a4b12690c88ffd90ef389690f374d78be1e6f9bce589c1
MD5 7c2d9ce9230f3c2af726c2c999b9bf7e
SHA1 76d2e769ca272a9b64c4b37aa85cdf86d3b73d29
SHA512 bdece8c801eb4c9f583338383e3941110023bc4cf5d946a0c2ae0764b5270e72ed6c322404b71315515a29b3083a8b5c6b30b39c069f531da2d72148bfe4662f
SSDEEP 24576:I3YgnJcRTk4yti+R5dBR/ggXe4i7ojhsP5Lgrk1TWb4AN5:IIgnaTk46pBR/ne30jaNf1TWbdz
TLSH
T18545BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 b10b86c405c43b5ac1fb7ed5b23672888df3f47e0da37322efbb4e569c918301
MD5 43063a870bd4791d420bc0941047201a
SHA1 f7e4665280055dc615d84cd886fe8c84afaa2dca
SHA512 b44fb0ade30f690aa937e44d77a932a3e5625cd0d08b069f9b537fccba5beefb84741c64bfceadb50084966fd1e2961b81d98584d1051a8efa3c6f1f47811513
SSDEEP 12288:040DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:05gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1234523919E5549CAE24BC3F490E7C791E5A01FC133014EEB16E0FA531ABCCEA6EB8459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 1a1648c74c0c50445da197556694820b694cdd2522b06063c2fdadc8596a714d
MD5 4990abcb14ed879e28aaf214c7c16674
SHA1 96b3be4c157586ad83997e1bcae871f6a39b2f3b
SHA512 b8b6de0a8f1762409d7285019d6c9135436f1066e1e8842cfcfa9f753c428b0058919493759376b6cd3a88f3f1ad1ee62184db8ba0d2306413c92b316e8c401a
SSDEEP 12288:oOb9A4LWOsvAYFT50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:FpL3UTmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16B75F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A84B661F637E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4d64b716f9eec9edbab500ef221749dcc2f787d719dfc186392c6d76476c843b
MD5 d7924eac43719341a46751c51e4c7fe9
SHA1 057646cf053ded4278a0cb12aedfd5e30b842562
SHA512 8790a5aaf2181adee1bd3645527898219b051ba61135496636a9151b91dd88e0668b60c9d2012f03f633f43716955a1a5be281b377349ceecb6c61395f559ccb
SSDEEP 12288:2pFtpOd0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8OKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F755026A3BEC10D5E16A927C85D38349D3B17C92171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a552f87f4d9e2916b8f9d33b0c02a0d2bd7c9aacba6c1ab56d75dca81bf5ea44
MD5 693d4d969960cc8a2321115f33f5219e
SHA1 98e11a5d41d47da297aaf54b00c38521534c3b98
SHA512 72a0ac44753441e5738b87facfc0433f74e3742750cc571bd1bad346c49312e11c940e7f2a142e1101368130fa79d6d1ce63845e6454270fd6348c30b3580612
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsFgXe4i7ojhsP5Lgrk1TWb4AN5:Z7cBWMpPjN8DbEhfe30jaNf1TWbdz
TLSH
T126659D2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1262833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 b4c4f96622979c632a93ac5c0926d26c38449692696e734cb2b85af51af19bdc
MD5 04413d4d7f2eae6898070c5f7a2ba70f
SHA1 d258708efe6952d99d8a215d65375d4de05ded00
SHA512 6243ed0ee745bb784df220e7251f8626d06ac02c956a1cc66ebccc421349ff200415eaf84f09422301dbfbf4af276e215e5bd1983122cb7956070e9fdad454d7
SSDEEP 49152:zF2YuHNETovAvNYf8kmwe30jaNf1TWbdz:i6BCf8ktU023W
TLSH
T127857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f6f1cb8d5ae64a7d1abb2f6b05bc654dd48a09ae22f1707692e1f2919048d90b
MD5 068f32b39be95c8c022274e652718150
SHA1 2857993a29f7fe8c53489e7f7cf26ca8863834ba
SHA512 cdf9564235e80d16697fdc57d0dfcf094227269408a68e6fafac07369626432890199d57605325044ccf5533810c00f9b9f632763b9946c3e30b77c67477c60f
SSDEEP 24576:OAFs06+Omlf3NXEbToOgXe4i7ojhsP5Lgrk1TWb4AN5:HFs060lVXuae30jaNf1TWbdz
TLSH
T1C365BE2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 a8adc8a9b7a04a010e066e9a877e70390d275fe9cbdbbe64a21d4b36a83e40ce
MD5 e1d092b668a711e1bac63597d1f4787f
SHA1 c2c31e681922169ae7cac55bb8fd5016fbc9d3a6
SHA512 a60f5b1510db2e6187acc79691ea4dd61166892604dba4fada68c1b41b3edaaf39163afdf94fa23ebf105fbdcfcafb4b21c550eab554b899b79407925b4baf9a
SSDEEP 24576:EJnJ5D3WXjgXe4i7ojhsP5Lgrk1TWb4AN5:EJnJ5DGXae30jaNf1TWbdz
TLSH
T18775D02DD2A810E8D0B7C3B4819A5795FF72386D2B226ECB14B4D5353F12EE09979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5f05e566a289f56a1a17c23a761cca39ae0e956e9f9e3af51d7c95064c72f49b
MD5 ca9a44cebac59d34d2805c3ece536b80
SHA1 818ba1e08c94fcd03bc431a3ca5d39883bd27ada
SHA512 0f131fdaf72aabd21d04460313e48ca8007e95def60da1555b04958f441741ce8c330103a8dfe5ed2c30d60915e587ac969a9626516c4b254e6303cf04496df3
SSDEEP 49152:7g06DIKdwc+eQnSt65aV8e30jaNf1TWbdz:0GU023W
TLSH
T17E955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 177ffd121601c1c616b62f983578771606158ed616d79fb5d0bf59e19fc03a37
MD5 63239ffdafd833513e9dbc0517882d5d
SHA1 3a3eb61445cf27a11b6bc19a5fe9859c9efd4205
SHA512 9ad5a0b7ecd280a7a026846bdfb1b1ea9c68727f044b71228585edb019b7a22e6410381c2ae9b9524bd358f490d585dc043555bd9098d8b771b69af90bcb5bff
SSDEEP 12288:VEP3RnZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WnGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A855126D6B9C60D9D16BD17C90E28745D3B2F4A127421BEF02E0D27E4E779E92E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 5b4f8d5b4be277447e6ce76cbcdac89a436d62ab8751997d7b88a6c19493d8d1
MD5 8c0f4c340652a6172f26c24d57225e63
SHA1 4fb4be42e05c16e0ba62c6e0511470f0343715fe
SHA512 c9babbf50908b1290c502cdd00c8ac3e393cc3c6005c87a0587a6edbcb02724c99793fae8fcdafff516d9d448dd5f119b39002f9899b55e254045fd6e7c968bb
SSDEEP 12288:Mjky70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MIy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T123551205679854C5E2AB8278D1F38390DA71BC606B1087EF51D0FA3F2F7AAE4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 ccdc9bc178c03d0330b4aebd5bfc3f7560333edddcafc64cd9b1fb7d129a0167
MD5 a4b2a51dce5f3c0037a53dc32071ec7a
SHA1 3c142a8f0f884799fca26c65ca9cf9df273b2367
SHA512 eebcc6d88a5a2536ea23529159075260bbde369ba4be37c139b4f740641c15e6af430fc3c610b07875c0f77528cb28e45aa427b24b7da36886161b791e2f9399
SSDEEP 12288:Uyt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:h6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EA4523596A5559CAE247C3F490F78B90E5B13ED137000DFF12E0FA734EB88DA6AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1a4d6bb599876747cb8ec24c78b89370832fc746ef7be5dd264917d059cbafc4
MD5 eaf23b6c8d896ccdf93193d896dd5334
SHA1 4bafe2c36b5b1b98355b25aad562fa2e52110fd4
SHA512 afe6c3dbe3fdd626f2203dcc43842351441295a0992ffe3da34cf6aa2dcff45504d99d661a2ddd7c24f4f96bd120e78c5315c28c7c69936535d298737508a288
SSDEEP 24576:XQ9MxZKdcz9dw3tgXe4i7ojhsP5Lgrk1TWb4AN5:XVKZoe30jaNf1TWbdz
TLSH
T132557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 6fe95c8b3dce742f63109371fee41786ec2bb3de26288d0f9a7700b90dcec4a1
MD5 f61d78f3fe56b28844172984e529ee8b
SHA1 7afb2489d68266319c3f33df67ac4c021792a1ee
SHA512 8dfc8cabe78f82cc7ab5a18494f423aa08eb985b6e9dbb78d6f19f32abc63cc1939fe18b485a7c1523bc031d7279103742a3ace5d78ea6d1419e1f7cd362e316
SSDEEP 24576:GyocDApcgXe4i7ojhsP5Lgrk1TWb4AN5:bocDApze30jaNf1TWbdz
TLSH
T16965E01FBB6940E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dffe43644580e182cef5d8d043964fb757fdf663b110ae30c933f1995d3f2926
MD5 02226dd9e1f002f39e72032426ffb752
SHA1 8d20e604fca72b79d7f5187c78ffa051d7f14e3c
SHA512 6d11f7ea8906434cf4f3305ea72794c88a8c6335cbbc4396d7f0eaccb21dffaafa5a0dca1affbb2c8c1c396355f4a939cb162e78aa5a1b5740e56f637462235f
SSDEEP 49152:HWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKze30jaNf1TWbdz:/0zuNIpU023W
TLSH
T14EA57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6eebda7fb4c8ad5c81a6107cc591f4457c8a6b81022f691f62a00642b8c0cbe9
MD5 fca5f4b0de353c34213d742d5d42334b
SHA1 5c6ff62645ef1573f59ebded673485df9adde042
SHA512 84149667808170bec4ffd0effaa498f7a46b586d5e7ace1b180e028067b34cbc2c96e800082ace75533986c156c57e695698ac0d0cde23b4664cc16ed57c27d8
SSDEEP 24576:y1QT7EcpfxR+N5AWAz3ooiYtjMqbGgXe4i7ojhsP5Lgrk1TWb4AN5:vTDxR+N5YzTfjMWe30jaNf1TWbdz
TLSH
T1AF55B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-265-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/224-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/224-258-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/224-263-0x0000000000740000-0x00000000007A7000-memory.dmp

Download

memory/1060-274-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1060-403-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1060-328-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1208-323-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1208-272-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1372-23-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1372-24-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1372-15-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1592-6-0x0000000000B80000-0x0000000000BE7000-memory.dmp

Download

memory/1592-0-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/1592-1-0x0000000000B80000-0x0000000000BE7000-memory.dmp

Download

memory/1592-29-0x0000000000400000-0x0000000000610000-memory.dmp

Download

memory/2092-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2092-75-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2092-69-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2092-231-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2100-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2100-61-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2100-77-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2100-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2100-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2228-32-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2228-229-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2228-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2228-38-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2520-601-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2520-324-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2780-311-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2780-242-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3216-304-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3216-414-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3408-418-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-439-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-449-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-451-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-452-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-453-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-454-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-455-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-450-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-433-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-434-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-435-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-436-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-437-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-438-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-440-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-441-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-442-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-443-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-444-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-445-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-446-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-447-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-448-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-417-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-419-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-420-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-421-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-422-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-423-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-424-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-425-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-426-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-432-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-431-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-430-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-429-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-428-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3408-427-0x0000029EB69B0000-0x0000029EB69C0000-memory.dmp

Download

memory/3948-247-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3948-254-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/3948-315-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3948-248-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/4180-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4180-287-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4180-281-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/4180-407-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4224-411-0x000000000B8E0000-0x000000000B8E8000-memory.dmp

Download

memory/4224-416-0x000000000BDE0000-0x000000000BDE8000-memory.dmp

Download

memory/4224-369-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/4224-401-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/4224-329-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4224-602-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4224-385-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/4224-415-0x000000000BDE0000-0x000000000BDE8000-memory.dmp

Download

memory/4244-307-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4244-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4312-312-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4312-465-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4316-278-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4316-404-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4424-413-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4424-299-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4424-301-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4424-293-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4584-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4584-230-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4584-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4584-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4648-552-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4648-316-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4724-243-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4724-238-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4980-214-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4980-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5084-320-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5084-595-0x0000000140000000-0x0000000140216000-memory.dmp

Download