a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Size 1.3MB
Sample261102-yncjkawyds
SHA256 a57d9c3b271e4af700f453d130408b30dba17f795252f42b0bfab8fc04c3033b
MD5 e52a026472c1aee67d4df0ae7b4930f4
SHA1 d4343b4e345360bb9a7cb52145132329851ac7ba
SHA512 0288f01b50d86dccea7f13f46643620407c1635e41966392562e76557825bba084cae884adfe75c26b6138ba0d1d40ece732dc9ae12af5d5140586d0efa03cdb
SSDEEP 24576:k4ZZQufMz4MMMMMMf8XB6D+InjioCsqjnhMgeiCl7G0nehbGZpbD:kEZQUu4MMMMMMf8YDtnNGDmg27RnWGj
TLSH
T1B35517D195C38CDBD41A0A316474D9B7142A3F246B74A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2720	alg.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
1072	fxssvc.exe
1720	elevation_service.exe
1216	elevation_service.exe
5680	maintenanceservice.exe
6088	OSE.EXE
2816	msdtc.exe
3108	PerceptionSimulationService.exe
552	perfhost.exe
4360	locator.exe
4648	SensorDataService.exe
4616	snmptrap.exe
4800	spectrum.exe
2132	ssh-agent.exe
5368	TieringEngineService.exe
5468	AgentService.exe
4044	vds.exe
5588	vssvc.exe
3472	wbengine.exe
1328	WmiApSrv.exe
5648	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\918cb031227ba850.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107609\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5340	5432	WerFault.exe	83

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f4a015d046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f4a015d046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb3b915c046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e524db5c046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003175ab5c046bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5324	DiagnosticsHub.StandardCollector.Service.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
5324	DiagnosticsHub.StandardCollector.Service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe
1720	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5432	2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
Token: SeAuditPrivilege	1072	fxssvc.exe
Token: SeDebugPrivilege	5324	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1720	elevation_service.exe
Token: SeRestorePrivilege	5368	TieringEngineService.exe
Token: SeManageVolumePrivilege	5368	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5468	AgentService.exe
Token: SeBackupPrivilege	5588	vssvc.exe
Token: SeRestorePrivilege	5588	vssvc.exe
Token: SeAuditPrivilege	5588	vssvc.exe
Token: SeBackupPrivilege	3472	wbengine.exe
Token: SeRestorePrivilege	3472	wbengine.exe
Token: SeSecurityPrivilege	3472	wbengine.exe
Token: 33	5648	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5648	SearchIndexer.exe
Token: SeDebugPrivilege	1720	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 2248	5648	SearchIndexer.exe	127
PID 5648 wrote to memory of 6084	5648	SearchIndexer.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52a026472c1aee67d4df0ae7b4930f4_amadey_elex_lynx_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 488
  2⤵
  - Program crash
  PID:5340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5432 -ip 5432
1⤵
PID:5840

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:928

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4648

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4616

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2132

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4044

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2248
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 79462751fcc828f934b13e0c6936f1ebfa63304e7af3b0a6c12d04d887debd39
MD5 e49558f8095a27efe1a29ab33e9c094d
SHA1 04414b458d68bedc921b804839474e7b1f8c8632
SHA512 2b68354bb69caca575b08b1a1cbe2a22ea0140c5811aa004e5f301a923e8ee969e83cac67ebe46fc35ddd5643ce2d7889f73f57e44d64ee333225c37a65d588c
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnRDmg27RnWGj:X3q6mjBGD527BWG
TLSH
T1E0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3ffcd07fce4764ccde542daccff2b9d1f441b222180204c45b310c730407859b
MD5 6b55e052c6041d4c55aecfc4202b242e
SHA1 902700a71efefdd6905f5426b430aa449c170737
SHA512 cde3bf00cf7e3caeafbe0cdbc574530f08b840b31b7cc311eb365d1cacd3297a059baff380de39a32aa7c3a99b5074014ff7e9023cddf5aeab0f3867523ba28e
SSDEEP 24576:IXYfDtczAesqjnhMgeiCl7G0nehbGZpbD:ftcrDmg27RnWGj
TLSH
T1CC650129A3D408F9EC67817CC9A2C506EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 1ac9d002cb9c2f8d34b2eb6d0190565d78d3e84072446db107ea6d5738446d51
MD5 19bcbf3ea3f860d3c90640b548592138
SHA1 f4c898f3733023a4f40cf4d82a750f6087f4d4b5
SHA512 ff603fe401e35f54334788e6bd77fa35d047830fcc790ef8d0436011c9af7b2a829f85271d2e3cd1d6cfc846035d8c05c20a4882a1b96178497d577a126106f8
SSDEEP 24576:k0Le5ji0hmxhrM1sqjnhMgeiCl7G0nehbGZpbD:kPji0AzIDmg27RnWGj
TLSH
T10C859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 619545351344e1fc831629af4ac04c81f232353dbc48455a269c41ae0b42b8ab
MD5 af6918189a10c36d50e38ac75a763719
SHA1 cd58de72f5f33b5f568302529afa40268d94f21c
SHA512 d3da67f7a4cae83f6813621273b47c6d0d4e800e6f822afa78d8a46f0b4e137cb950441fbb7275be49c4d2561906e4ad7d0478bbfedbc41d0e074c0bee5e0daf
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWj6q8wyunsqjnhMgeiCl7G0nehbGZpbD:D/ezSC6vUzPv+HjyUDmg27RnWGj
TLSH
T172755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9e36db6b4d1054b0d1420ec68258549b3e051d67d141353bdcab0d849e7cf522
MD5 bcd911007086378abcc6d1991b99d346
SHA1 e0c96bc11832834c4b5a758327aa04f0cfb81f44
SHA512 e648ffd5e22abe02e780db7bf4f204f5daa8a590810b6a8822c59b2fd70b0db08e0a4151c4a43eef8326017899a888dba4c0cba75954b56804e044e2654c312d
SSDEEP 24576:9VbqPb88hv/l+BSsqjnhMgeiCl7G0nehbGZpbD:9VO88hXl+oDmg27RnWGj
TLSH
T180559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 be4524e9bdb38a01a5af0ca6e3452df350c075b18a0d63cfd4397d36d92a1016
MD5 8ea335fb82ea78319de6ab9ccea7e476
SHA1 d9248887de680e67d242e0dc8443b1fca3203958
SHA512 8bdef49c4cba3d12c225485ca0a8ded67796db560924398298f0a9b0db4834d192c85c4adecb0258b846d50b602faf97dec17fce11cdf0266c2c0715fcc54f02
SSDEEP 12288:qGpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qGpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF874C50CAEA7608B5C3E9F11EAC137E56982008436AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4219f6ff1eb257477eb51d4ff385f05de6f6dff61761a24e44a80a8236ca4f70
MD5 dd96806d29f1b5cd91dd021655bc72a4
SHA1 68b49e1ff0abc38a744ac742cfea4c1573856644
SHA512 cf768997b9b2ee584e3f8c7a0035ca0df2b346992ef2ed45d45fdaa94e3486d5fb2778b3b9305a6aad0eb3842504890900995e15224e91ed26d2485b494ac5a6
SSDEEP 12288:seBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16365CF7BEE28FCD2C27A8DB85791C600E77278314B61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec7cc8685b1aad71dbe2599062010bea9e69dd9fa4919ffe77f9da3b3342d278
MD5 93d025f25ea6beaee8f73eaa736580e7
SHA1 00cb6b945ce7648e3afca22a48e7603a7099f41c
SHA512 27f2984a73f95e0567a374b3bfba3178508ce52eb271dc7aa8da6c23bf006b688335f5127cbe28b0e0b09acee76b9eff96775483a0646c6238dab2f8ba9723a4
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH9:pQvGAdlCEL8c/WRNw5CLD527BWG
TLSH
T132266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 52e7df6e90d3bdedcda1e6351ab9b682785f68375cf761a3b6ba5f20e0b285f5
MD5 f8095daaf544e73b41da552db6a139e1
SHA1 a1c5c6b0ef6a26b53fbe968419851676ca74e120
SHA512 29caebceac7a1018cf08065092e3266806dbf53db5546d75f516d8a686d269270ea7efaa9a68e15168651b2b31a08cd423be0a17a60c9d88dce79f706be18376
SSDEEP 12288:jAwSfxL/2Dc3mDLLmt0LDQewsAjsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:cfewsAjssqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B75E031FA74E036C77B0DB20B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17323f464a11190288a622a486d84f973fc0cdcdf3fc5ca910bbe5fc71d352f3
MD5 4e26e72b67a92f563f68f15b4031f853
SHA1 e8c2ebf2fb8df380c9547553df82603b8cf6da17
SHA512 03be13b2c372770f363ddade2ecd4c77dcafd5bd8b98b333ff73659deb2aae34f088f49ba1dbf6cf2acc5329f62463a68523e6155affb6991085db2a6cf0b24e
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgVQBWG:7UEtQevvqc2W1cpV20I32nB
TLSH
T1A5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ee0d347c0e0920aff2d30cd73107092ab02b5635ef3a8737ad82387befcfa410
MD5 0a5bcb3939afcb5b66cae9cec71583e6
SHA1 cddc3a3288ffbd36d8fbcd0e125ef4257efc7e23
SHA512 52f70a73bccfe9c0d9e50dcfbdbbd182def0309845391980770e4c37407d0975a9ff3fce1b4202f45eb554311fdc2ecf4bcfb4914b9b9e1679b34e4227b8a52d
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/z4Dmg27RnWGj:goq2VjnmnD527BWG
TLSH
T17ED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 260c456dbe94b43f144b3d94f12bb241ca42c2f7434db54d0227b6ceb2f5db05
MD5 41b4d5ae690ee6b2fa1f105302d8c6ca
SHA1 b1f30fa365836ca58cad453b7fc9736e71731fb7
SHA512 f3894c5a2cfe72b6dd9fcfbb69a17d9873709d4ce89f5be9d9879d08c2bfdba2ae7ede03f8a6cf62b39bee504df53016f46002fc2f8713ee59e1d53310982069
SSDEEP 24576:nAhGL6IFoiwtA5l7S53DsqjnhMgeiCl7G0nehbGZpbD:nAM5Foiq53Dmg27RnWGj
TLSH
T116359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 df98fb4c2a676b7d8aeef89865dd6ba0f9b686d853f46666db5668436ac0d7a7
MD5 0c8d8657254d1b0f4b37b0adab64d29b
SHA1 52f81f00f911dae16c8c99f0cdfeea2f674a8c1d
SHA512 ec1561d11779953d1137ed069e80982dbc61cd26550c76939fd6cc728407ec8888729adddf901b9132152abdc0bd3868c8bd25c34be652afd56a55f3154a3ca5
SSDEEP 12288:Qmw5HEjsChNEBFgl0WDm+CHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:NwuROWIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15265F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3244bf2bc22d4ffaeb36b8bcb4b65ce65505dab72c8c209f7c0b7576b215fb95
MD5 ec43c2c4aaa1e2ef2ab7cb2e5a67de83
SHA1 13ef81fe245d0eeb2659d745990b5c9e0d846763
SHA512 89c05c6a987f9e5b6b156e59d8b55684e6a1e8d934a97553b60ac319f563868c9e61c2b5d798c8fad45495e2860f3549b014e82f98cc84bcae08214c542c6dde
SSDEEP 12288:AyZ1Iy8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZu9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C95512AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6edc31db7c4d46b6090e120f4924f2d86bc6a5d6e8b91194942b53e3188605b0
MD5 1783e3bac9754e2281ab1e0dcd4d9050
SHA1 aaa2d7e5482206e52caf1a11657c53db7908a4f2
SHA512 72ed92366ce09dd18a8d61c5c60dd51be86eff00a090fcee37db655db21283969c649a0589765499ae8634d2d768dd36f4b213d00437ef0d6980aefcca5b2d6e
SSDEEP 98304:5QRQyi36YOcPDLvw2gAf+PN3KD527BWG:wQyiKanX+PN6VQBWG
TLSH
T117667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6e599807e0df053bfe79137656562b31e93f75e05e9d4d40b6859a01c9da5301
MD5 5ae1896f12e1274880b812dba6cb03a4
SHA1 ace72b12ae666672c9b1cb5c1e0060157bae4c8d
SHA512 73ec03ef12bf947c4db7f570dfbed72e9a55e93917daad24c56e850afc88148cf98116558d0c43bc02f851867e0e5fde3d6cccbd5eed73a6fd394381fbb95c0f
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3KD527BWG:sQyiKanX+PN6VQBWG
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 769219c74f2f616788e83eb8ecd5c831b42d1d2d513c87ed7a986016756260c2
MD5 5c83e3c0d5950303644dfc73ad68ef37
SHA1 efb2dcbfdfe3f260883f93e5f9321db296e80c40
SHA512 47a176734775d1d567c443797fdb5b9475465dbcb47e19ca2702f35ced1baf22178774e13e6d8d921994896ae15e0cc86478aa256d139585640e5ce77ce34253
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0tsqjnhMgeiCl7Ge:M68Qg55nhkeWu7PNU3/IDmg27RnWGj
TLSH
T136B55A33B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9af0662c55e64f6ef4f2222b9c167c23f6ed93c5f59a9ea8651de49d1f056adb
MD5 55184b4f3c51f64b133be6f9a18ab588
SHA1 5bdc310bc482ca885abc15f55829e512d2762404
SHA512 8c075bdd038a5e73af72cf57bd97607c7283c6071b6efd03eb95f01d6e307dcc96c1af99e60cda685c7375de609eccc4735f51c126e08c40d9214d53d2676cc2
SSDEEP 98304:Wy5112gYy5azzVvU69nLKnhZtD527BWG:HLIHRWhPVQBWG
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 bef7c1c583c3cc603ae47647f30699cfb5e1e751b3c72603ff5664e1ae578127
MD5 ea8e9648587652c330ade5d60ca88519
SHA1 9e541f0d2f2893aca7939efd514904f3b44b3a8c
SHA512 1050e3ed2b4d5caab0eef916ffe352cfd20c8ff207c6876806483f46fd5a39013fc620297e10238d7196cb6a5a4afbe30f6ed636ba5c3291e974675b44d3db26
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkDmg27RnWGj:Xu6JmIxd2dkD527BWG
TLSH
T1E4D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1612695b10f19587b151104962bcae8c70abfaa8ba118feeb5a02dab4165b533
MD5 f202cab37751a14028db3a2397f2647c
SHA1 48654736815563d05dfe5fd665e20fbdf8773af2
SHA512 51ffeb7ec93ce7e70d3d7a17a19312b0dfd919c88e26915371b6481091f412c204708394da3267033ec4a50326a0870c9b40723d1634c6886dc4b97bab0c73d8
SSDEEP 49152:/1hpsNoJpF1A67U44CwH7R4xODmg27RnWGj:/mifPqRnD527BWG
TLSH
T14FB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 413623523875b2e3de565d8e1155c456f42006e80b0f4ad005da716e5ff0852e
MD5 8d475b0f4ab55677ff52d9a1263de148
SHA1 acbd61920d68dd217f9500981f5574c3a0176d3f
SHA512 f10f2bbe7b15355fdc7560de097a0f0971188a14588cd215b896874dc3454b4154f6d8b27a2a3c5784a525a990cc4c87f7d449241ca089b2174f154271c904cf
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHqhDmg27RnWGj:z5dKqi61hD527BWG
TLSH
T191C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7844586e5fe1c992b373684271542f9f229846322c7cec44caeece84e83bb914
MD5 d6fce2d59a914355b78fd9659a70f148
SHA1 1e32df0a0421eaf0efda8840e8571e1c84701383
SHA512 0fc88aef97e0e8c8e77b6727dcaaa489197bebd3e9e3cbefa08fc065f36cabc7d1d2cb4c2a7e39d8263863c6d4e565b6f7d9fdd31efa75f9d5dacf9e7072a9ff
SSDEEP 49152:VhtSn8EApI0figjgiDn0AP5wyDmg27RnWGj:kX2iWphTD527BWG
TLSH
T1FA95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 2a5b23e7c5f88f41d23b3fb430fa911012175063e2907dd760030afcf44f07e9
MD5 e136fee3e37ad1b061c0daa8a6edefa7
SHA1 ccf77f78ca2fde29507c9a712fab28929f5ee478
SHA512 1bb4a614aeaa0ba0b3030d8bf416a14448d8a25256d3c4935a36d6ef53916599044cae749ec82fa9f67112bbaf1a711eb2438bee9bc8432f9417184a7b02eed1
SSDEEP 12288:2xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BE965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CB9EBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 53408f0db1556867d38a84501e293804bd108706101448c73f73f23b8782de52
MD5 af9d45c0d31d57408354ee142e7441e1
SHA1 b329dbea6be60f2bc70786b2026cc52773c34714
SHA512 27a2839bf7efc84bb87344e3a9a2a5563ae105eb97f4edc83a97a2fec0b1cedc7c925aed0b576348722c9aef2046692b2c9567df280de10805456a8a9b227295
SSDEEP 12288:1AXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1AsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE955C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CBAFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a2d9c38e82e34eef0854dc6748c14f2e0da9e8db22312a14789e16cd9514f8a2
MD5 61c18790a52efcc0ee64bec6e1fe2df2
SHA1 3e3d3ef160489e30e1cb7e3c0a7da75b64df3398
SHA512 7e47087ceddfdd72edd606ce114a5eb2ff65f1e8448ef960b2f303c475e0f136e8ef546bb3f17fbb5f171d1561ab11deaa72e5ad6f2601bc43c53c4ae779bfed
SSDEEP 12288:SCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1064523BE955C41CBE52648B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38463
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 813d7a3e9d9318f7795b7ed02bbf789b12c0ff3d5afbe980708284868c5b5a46
MD5 c089addc95e3d2195454b211071fe4f7
SHA1 b55a1e0a9a4611897059336d6fef882557fc7ddb
SHA512 c7b86c8752d55d5cd2b0ee544b4757e0050ff12c3f9969a7b1100e6f1ef68ccb108e39e65e8dc912f47c1c92e3822ad5616d1116c36433e020efb95b0672da2e
SSDEEP 12288:CVjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA45236F575C01CAD83685B4C2F5E10DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0ee4f145f511af74520904f8a97311d14390ea395bd0d8a1fd19f422e06f77e5
MD5 e5f555ccb44c5cbc9c3f6639aa203c2b
SHA1 2d92ff6a6677640baec342c9e61993f15e182993
SHA512 ff4e362983aa6a1fc7bc56f97cdcd2388fa2521a93dc1fd93d559cf5da79ee95ffd89bacf91b30ab521f3034281f4c5abba747fd58ddee026bbcf5065be91b3b
SSDEEP 12288:/7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BE955C41CAE52648B5C3E5F14EAC073E5BE92004837A9B7CBDEBF24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8c2d90116fdb0806d97088292da04079e1d250a6c2130e66bf5d3f4261c42810
MD5 548aef1bce729480ea26548b4629b437
SHA1 2e7a7fec9f4c62ceb3ff15d4f81b14f22ea82e81
SHA512 d63be1fcdcf8e4d4fa550942c86d7dc8ef8e7f7a4efb6d5739305228b625e6603b196f3c43005edb32417d495db03d288344e43c62c1421f3907b7632bc14d34
SSDEEP 12288:cUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0f294e5922a1013855664ef51467042db698982f6f3b5b25571ccbdea124ba7d
MD5 ae32cffaacae11d75b219f867dd2faaa
SHA1 f0e9adea0b8f619741d21019d96548940ce9e76a
SHA512 e7fd5ac5bd6528b17d3ca3f9adef616c1d0bcaacf4d1312efdad00ac298f4ea7187bf308904060a54b0b1dbedb3a44eeb01924043d160bf845ae251d0d5dd31d
SSDEEP 12288:M4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BE965C41CAE52644B5C3E5F14DAC073E5BE92004937A9B7CB9FBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c9bd0278952ee53db4dc17cd6c0538af867559ff15a8c1d0e7c5e23d37055740
MD5 8ee08ce5f41466d999202836a5a8c2f1
SHA1 57a27063f56b08e0fd4db42abc42015680d9d71b
SHA512 de75cd124e33aa65053c54cd0db822a73309203a79d00dfc4e333e437ebd31ca1c1e562eac57d94db67e7604d464aae662968c2e7c1863d5ddfd9b86e4105901
SSDEEP 24576:fZM3zFVSOgsqjnhMgeiCl7G0nehbGZpbD:fZM3zfADmg27RnWGj
TLSH
T1F76501A9B35018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 32fd5360eac2cc488f20915ab23d22d422ad0f44cbc32c05d44258c29336670e
MD5 fcf1e019772632f91e85e0cc72fad50d
SHA1 a5482664462eb28962074bb5ca929f8bba95b7c8
SHA512 27751241052824022b7da9112fc96b274048dae9e2d1bb6d0775e2dbc0dc4f9a4011fc2b8bac3c05c979562d797c3395f75ec7b240ad0986248fe48dc18c86aa
SSDEEP 12288:dNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1744523BF965C41CAE52508B5C3E5E14DAC173E5BE92004837A9B7CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 14410a9c05fdd1a30efeacd8a60216a91a9fad775b1967424e8c55c09d3003e9
MD5 7c5fac60f588aef329dfac36ec7c43ab
SHA1 4e1396e5bfbe86ae86c0de50122eec7652ad9635
SHA512 7cbe97e0c3e90d8c7cf06ecfb57b1cecb0e814c2c9fe3b5cf0bd5f9e7b619c1a359298b15fdf54b8f8afc486418a3e14c769b072682c8f494f3372fa816d649b
SSDEEP 12288:D5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F44523BF965C41CAE92648B5C3E5E14DAC073E5BE92004837A9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 ddaefaf8657e85e7095b0fca08c49a0c8fd93f1579335f8b20375821f0f50b60
MD5 16ed245a9bcadcc74815419e500e524c
SHA1 5a96e040aa1d5412e4248363c96f535be8cc27d1
SHA512 0493bae127046de2af4c43ff4c8dc1d28e01ed0dc752507f2061f345945e32c4613e244adac7e1037cc0725166b9b0480769679861b0bac69e2877cce49b6e6f
SSDEEP 12288:nyPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Kzy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 23fd2963cf8128baa38ae084f44577f09ba5859fafacf81a3fa8f37db08b1a18
MD5 2f98a3c17f7a63e1dca665b37750219e
SHA1 f9b41d4648e06016a07ebfa83e9c450631fda742
SHA512 b09075f96baf2e0a1d7a8d402740610f5cb45107483bb1bf4afee7c138a8d0d6da508b47949c85b00a428cc0fb22f05bdb1160a6c95bfb89900e140e6bf935f3
SSDEEP 12288:CNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BF955C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 fb7fb8b002827b5229f3806a761d60ed91dff7c6c7055ddcb7370bec0d29c965
MD5 51167fd806573025d4fc67d0300bf4d3
SHA1 afb869bc93ca174d321119d3e276137b56532a7a
SHA512 ce263b8743f28e084d25aef98b8a1a249912959df03037b7c957e8965b118363797c9515da19ae09c737bfb0aa46d48fb024169b1c1684fd657da8960e66f2b6
SSDEEP 12288:INXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:INsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BF955C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 cd1b867675791acaa8ba4e8c5e56f74b615daa3cc28648fc4887fac7a606e582
MD5 59a8a3cfe20f884b02a4455a1be1c313
SHA1 75db367e585382968a165613c557b24113f8756e
SHA512 d0992eb822001915d65020cc302cccd1d410bc0efad5e80fdb843f2dc69acb2e995d9deeb752048dfb9396e9f1f799a203643ff4dcb32f7c519777a9562eea70
SSDEEP 12288:myPz5L88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bzy8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B355125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 c5a293e5c8bd351ca2c947790d9a784961442ac48eec18cea14eed8f0c4b181b
MD5 4e50dba1740524ee348ffe935834120d
SHA1 fa14786991a37f4401a836f9b897eae5aa696c04
SHA512 acc17aa9bc539491cde82420839b2b4241967c92e8b67568935e8332ccad95c3fc4c76507a0a08d32346c27eb20af18861f4e3201b4e138506ab4018467f0f79
SSDEEP 24576:HT8aLl3z0zDysqjnhMgeiCl7G0nehbGZpbD:HT7Llj7Dmg27RnWGj
TLSH
T1EA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 951874116a7d744a08907f1e7362c4c46f86a3f33f06cdd88f7c7a2418d73869
MD5 01d4396c1125101bd8e2436cb8141138
SHA1 b8387fc6f14d7b33124f8ba420872d929ca5d806
SHA512 b17cf319c1186cf128e4980e120067bf923dbd427b0c5ecead3b7740cd5a835bc28ec447893599911290db9e19c2b138b500fbdf370304dffa235daba048548b
SSDEEP 24576:h3rd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:Rrd9CHKyaADmg27RnWGj
TLSH
T1D675CF90F3E810E9F0B79A35C9769512D9767C5A5B30CE8F03A4255A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4cec6c1926853e249d3f6b45ba7385cf9f87b868f773434dfb6db0805a920537
MD5 c6655221e66a4d3cc0be64041b09b0b0
SHA1 182e5144f55743ed62d6b293091357ea6e23e6e7
SHA512 1bbc5157081b6a797873115e5f0dbd9f768c3d3b8bced6e0fa7f94c80f20f32ca93b93cb2880516a66af9aff7b773daaf9e3fbc39be936551da60cb831655055
SSDEEP 12288:FiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FisqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE955C41CAE52608B5C3E5F14EAC073E5BE92004837A9B7CBDEBF24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 34d4ca52393388de6ef58ae3601254bb68b40c599ef060a7bffec2ddea8dc98f
MD5 6a0624abe800ab1544b7e4f8efc581b3
SHA1 0a911f725ff32c1ccc656c6ab07040081a7c9a73
SHA512 f9b6e0a712317de405a4d29865a3bfcef82af047c842146beb19ee93fa3599d6b40f9d606f447affe2ad79d62bb7963b7f6a5f72609e9e471a3c491dd9e65828
SSDEEP 12288:ycXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ycsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BE965C41DBE52644F5C3E9E10EAC073E5BE92004837A977CB9EBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3a6c2414de2aa42b87fd3e4ff4045d2ed1471e4b6bfdda821bf7314ce346e492
MD5 bfff5b467eb4ff36e50551bda31a35d0
SHA1 fb86ca452835cf1304695b4e19ae43da366d1c11
SHA512 c6840a03585cf07c6025b6cb1bce5144fff1b358d524700800db9b6ad0aab7f04064dd5eb8ea72666267d4f5a4e1ce2d63f22d7739bb216be23a3c9f1da4f630
SSDEEP 12288:y/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1024523BE955C41CAE52548B5C3E5E14DAC073E5BE9200483BA9B7CBDFBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 510db15aa92dbb75b8cab322d5e62c59ec69a3fca203f4cf4684f958cbfcaa46
MD5 1122a6ccad39065d74827d9f9307b645
SHA1 dffeb4c516a0f169c9180fcf155da0247ff2f263
SHA512 da49edeb96ffb3daa3d3ce6ac16dc6dd2d9a75799589f894f5b061b696b0c363588006a18d613fcbf4b8ddff032e5d2a22221fefed46eb6ebd2446c43af1264f
SSDEEP 12288:hpsf9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:y9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7a462c055857dd662e2eb3724e4c523e3b4b3acf811b59950438aee71d9d4394
MD5 07258ac1703036331df99a72f8f64238
SHA1 d82fb3a8d93c86b56fc62e109f545ea6fbf7fb87
SHA512 d399f6ba56c907274d3eab146ca3a75d9aa5fc7afd3435c20de4ebd2e65923baf4318fe76185847a5ae11e4397ffef07a5bd2263d4128392157eb9cdaaf48ee2
SSDEEP 12288:RdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D45237FD34C518BE57659B082E5E12DB80B3E669E204483BA477CFDB6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 27ae6ef19befbc2ff0f866171128a22a01123392bfd1ed7e7315ecd12b8f23bb
MD5 19f684c925b35d4ab51027cd0e28d716
SHA1 8ef41c22632883ef5d8eec5b8b19bb21ef7ad30f
SHA512 f5b9016c58be3daf9022366b067adc9fb1e2c04aa85ba69f98b07947961082af9d06ec798acca698aecc0856c6df79a58b0087786d0ceb406732f641626c8e7b
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQbDmg27RnWGj:La0hNYG4JwkD527BWG
TLSH
T11C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 576f904b0f54ce738a47cda97c16f1fb773ccbf307ee8330558820d09bfe9e7a
MD5 58f3cd6a23f6c4bacccba0c13a989d69
SHA1 2c1d7296e62209b3bababf05b770713719cc64d7
SHA512 beb4ce777e6e396fa60a15f7043cbc7a794b16e4758a15288f4bc124d6068d455f41e42792aa2d1e1efc5d794a29e197f4d67093e1f0bc82ef831f556d233189
SSDEEP 12288:lhbHjfXaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lhbHjPasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55127E16AC20C9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE84D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8442e7857b011db3fd8f272a78b64744fc10e60abb9ea59fb62e609a3077734b
MD5 73d9f798d7579a53a4607b44d480ce3f
SHA1 bc7d5fe52c11c0e534156945037af4bfb0f4f2fd
SHA512 1b718c22d715a70972abda62af1e40485c48c1f7278f7dddfd0c6544324c43461b0f710dba47aeb3a384e6ccd3c062d485b7c3225a546cefb57bc3e3b33ba8f4
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/ysqjnhMgeiCl7G0nehbGZpbD:fIgnaTk46pBR/2Dmg27RnWGj
TLSH
T1CA45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 ae1aad6a204651fb0bae261e843ff375731713c0e8010072c96e98d33c2a5365
MD5 2df58ae57026a9f98a9fe0bc52570ce9
SHA1 6d2fa47a254df7f20bbd1ad83e2bc9a1c6fb46b1
SHA512 757c11546a07ac3c39d0bea7772bb3f7af8a184c75bd7ab7265c35188d0ebd9d938040ad09e09e0851b4b7f4a948290251ee9b27f4757e1fc9bf340486bc0108
SSDEEP 12288:6RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BE924C51CAD93649B5C3E5E11DA8073F56AB2004D379A77CBDE7B28E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 0da1d7a166f65eb3446e367409028961306b3c062a78d78fa8f5178951ba683a
MD5 8826f66776ceab8cf4ed1339d51a7081
SHA1 ac5a83a86c5fa92239169e58bbfbbae5e9dcecc2
SHA512 c297059be4878a3152b67fcf5afe914dc8399d7a377c1a33408bfc91e837fc4b95f60a88c758944b535ce27079bb3518ea8d151a0d12eddc80cfb9438b4101d2
SSDEEP 12288:sObIA4LWOsvAYFTWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:RAL3UTWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 88478a1e38792388cc6e9ada501f63300be1d620064ce7f007bdb1a6257d5e48
MD5 43d9f7804935941dbfb5fc6c5cd9b13b
SHA1 5b55241596212f746f99b2833c5de5639a17aa3f
SHA512 24a985346cc068d088fac40dbcc15db2bf30960bad1fecab87a6055d2e44c2ac1e5955c73334f58d2a65333b71601d858d41a60cf8268e00214c376677f29485
SSDEEP 12288:+pFtvOqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:COqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17055022E33EC10E9E536A17C8692D20DD6327C66172117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 33905d3938c0a4583c26c4d42befc36a2aadb35e0c4dafc50dfc762259167e2c
MD5 070f3e380ec9dda69bee2510d6f7e26f
SHA1 d5d2f21103c8be3a0a57962eab115c72598a7175
SHA512 bd6239c46fe104fbc4de85b71353439f18550e05d69c60c9463dbc044fafd8fbdc86df45f342f766b2288731b12cea5d6f6bc08fec5a2644622a639d3f2aac2b
SSDEEP 24576:a7NM9YqZqmWMUkPjZM48Mv6bEhstsqjnhMgeiCl7G0nehbGZpbD:a7cBWMpPjN8DbEhoDmg27RnWGj
TLSH
T1BB65AE2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 02123905c327b90f214f97598531af1a57a6c5ed2f85f021d539abd1f7ef54ed
MD5 5ddca46ef7abb0e3f125bf785c598660
SHA1 46a7776707f02fac5be990402689cd7edc33e450
SHA512 c912fd0adaa38d5a202df20bcc6fdaf0b1faab22d4bb59a75be6aebb29c7898640d8fe1daeba10e4a44fe984cfd5ac7ea000022abcab417d1f578bd1baabc09c
SSDEEP 24576:zW6BApg2YuyuNDYTabvcdvNYf8km1TsqjnhMgeiCl7G0nehbGZpbD:zF2YuHNETovAvNYf8kmxDmg27RnWGj
TLSH
T127857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 a9a2486de603aad06b66a35700b1b4763f6b7b7487198442e3ade97a2406ce46
MD5 3bd11ad24ab89ee3c6a74c5b84f7745b
SHA1 dd24ffc0b048f68367c2e7c9182880abb4514ca5
SHA512 0b954f430e1c84f5d169c9744d7655402c7525399d47649a023dfe5d402d463eaf3b08150fad95987517183863c4cd629562ce9c6238d759a95ed0359f9ece1b
SSDEEP 24576:VAFs06+Omlf8NXEbToesqjnhMgeiCl7G0nehbGZpbD:aFs060loXu7Dmg27RnWGj
TLSH
T15A65AF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 f297b37e17cb7ba8f694a05ce2468f8973161f80bf0a05c57ad70ab8c887a6d6
MD5 67c2b99e21d5592b59a7b21f0f32e4d1
SHA1 d960ec1309b79efb8b3d9b54162885043e9220f1
SHA512 f440048c6260ae8e5515c0c986d45aac2d646f86c22fc5bf86121ed30cf734db4d375aaa5d65b9d571e0f66e30b0082889e09ee971001bd2ca0eb40204cde38a
SSDEEP 24576:LJnJ5D3WXnsqjnhMgeiCl7G0nehbGZpbD:LJnJ5DGX7Dmg27RnWGj
TLSH
T1E575E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8c728ea47e400cb5d15cdf860a1aca63fda1b8ce8d378928b8468a6820693cc7
MD5 61ba26b39c70c2aba929e1a912c0ed20
SHA1 2644a33dfcb2b1d05a85d9dd6f0228cfbbafceb9
SHA512 55b7d309a4c183f94cd55bc5af64ee2052c9c4773896c282faf3a9aec94dd754800e23bbf0ec5874da9bb41d8d86f56d1999d7ce8762f053b9cf7d1f9fbb0f31
SSDEEP 24576:zEPghm6/7IIXdwcXrif7qQncjlP65i3Vu0sqjnhMgeiCl7G0nehbGZpbD:0g06DIKdwc+eQnSt65aVdDmg27RnWGj
TLSH
T189955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 ae3d275c22e61a1b1d61bd12d32b4b66d17aead80878d8246c09147aece34a50
MD5 5e3e61eb7bf9aa09f320abe1127bc27d
SHA1 729aee0fa00436b5e339d48d6b4e3b333a68d405
SHA512 7606c46e454bd77d47062d02379a044b2216a2549ff1b9ab7157b72ce2ab4200a9cd84d3a9eba31da5afcb173a49ae8370c807149b970a3ccc66e62bc07356d7
SSDEEP 12288:XEP3RndXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cndsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE55126E679C60D9D536907D82A1C209D733F4716B2127EF26A2C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 66f8667b20a890a7c9caa4ab923f964df4b3f7beaab6a3336ebb36b20699690f
MD5 e1448af51af14ff55f2aada379272079
SHA1 ad10a68c990bd3e5d2bf2dd57f440d64491ae51b
SHA512 d0efde4a695d57c39647d1e2f830cb75f0c1f89ce37181a6a8b01496557c0289b0d38e3764537a5d2dab560cfe0b2e68130887d5f4379c758d21ee9cd2bd1178
SSDEEP 12288:ijkyMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iIyMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C551259639C60C9E9760578C6B3D1599C32BC31AF2042DF6191FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9046bd240f3c776cc78e699ec81d55eff8ec4f1eeca31b07c38b1523af6e8e82
MD5 4fdcdb6640129708302797bef440b53c
SHA1 23d54abcf894f8b3438ba33844732abf7a05534c
SHA512 30b03ad2d3e1c7c110fc4137a4b6c1edbca1578dc9f9912690d01f506492ccfedd44c2d26f4bb239a1725828f5428cb83d9641b49807b11c502d7fd583c63b61
SSDEEP 12288:JyaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4asqjnhMgeiCl7G0nehbGZpbD
TLSH
T14145237E525C60CEE92245B8C3A5E10DA8133E766B2014E775E3B8BDEBB24D44739813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 58e0fb1a3f9ed868873929d1708e3003b709e49ed99f471e217decc680205c3e
MD5 7712023aabea1d45eaa8a55ec66d2454
SHA1 d5b1e85ee609600478309d16c95333086c51403b
SHA512 b899603fd62962b269c635ce5a26060a61ae5aaeaa14999c29c4cdc02712300428fe5375336972021ade29344ea8dc60dd2644f0511be311836ff6e00e0b26e7
SSDEEP 24576:NQ9MxZKdcz9dw3VsqjnhMgeiCl7G0nehbGZpbD:NVKZJDmg27RnWGj
TLSH
T19E557C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 486a199365c1b1ca71c14f84ba4675fc0ab86add54e868b7dc2272d530e3dd0f
MD5 2bfdd57cc9be31262a137ec4140e9048
SHA1 6737e59ba1814f53864e9c931ba17e4dd63f8fbd
SHA512 c3a1e174504279562add42e276341ce32c227c9b4a72cb8c2e7cf255f16b40e7680fabefae0fd35fb931d52a8a6acae38dcc5d5b113288ee25304e347665b917
SSDEEP 12288:KyoKo2JRple9pgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:KyocDApgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15465E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 0e70e9c7aaa162d0691c29d23d2b85299a65cea9bea1c45f527d2b1c43659331
MD5 7dbf08ca47ed0233f5ca3aa7301df94b
SHA1 dddbe91e1388303441c6e12504c6627127e0a6bd
SHA512 85c733114d50bd0298cb40b4787402ff597c27ec46dec45c6727507ea4bb2e57df3c8e2ea94f08f6044b37fb5eb5a6f0be484de336f73fbd7126b95afabff53b
SSDEEP 49152:7WcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKcDmg27RnWGj:r0zuNIaD527BWG
TLSH
T12DA57B3DA2BC00A9D8AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 796e1764df5e8757f9f9e3608513d7d5cb9948439894ba35a14c39a1b5c1f235
MD5 8bd923096ab774d6ba1db81d025958e2
SHA1 8d6d7e620d6ba517472d5caafea9692ce5c8db4e
SHA512 0b0f385cb8a2e7a1c424d66676de48bcce3b3bad3480197ae318f9a6eed5165380bba65deb8155f04b9ce6725426f9196983646ca1daec8279b69a34fce72f52
SSDEEP 24576:u1QT7EcpfxR+N5AWAz3ooiYzjMqbdsqjnhMgeiCl7G0nehbGZpbD:jTDxR+N5YzTBjM4Dmg27RnWGj
TLSH
T1BE55B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-263-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/552-264-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/552-269-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/552-321-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1072-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1072-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1216-56-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1216-49-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1216-236-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1216-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1328-326-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1328-563-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/1720-235-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1720-39-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1720-33-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2132-303-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2132-296-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2132-408-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2132-295-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/2720-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2720-229-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2816-245-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2816-313-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3108-317-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3108-250-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3108-256-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/3108-249-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3472-562-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3472-322-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4044-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4044-560-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4360-274-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4360-325-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4616-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4616-404-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4648-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-330-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4648-409-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4800-283-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4800-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4800-290-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4800-284-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5324-25-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5324-234-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5324-16-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5324-18-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5368-306-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5368-415-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5432-46-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/5432-8-0x0000000002100000-0x0000000002167000-memory.dmp

Download

memory/5432-1-0x0000000002100000-0x0000000002167000-memory.dmp

Download

memory/5432-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/5468-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5468-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5588-561-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5588-318-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5648-402-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5648-413-0x000000000D290000-0x000000000D298000-memory.dmp

Download

memory/5648-370-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5648-386-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5648-564-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5648-331-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5680-60-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5680-67-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5680-61-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5680-71-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/5680-91-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6084-438-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-431-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-452-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-451-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-450-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-449-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-448-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-447-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-446-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-445-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-444-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-443-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-442-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-441-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-440-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-439-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-454-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-436-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-437-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-435-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-434-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-433-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-432-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-453-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-430-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-429-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-428-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-427-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-426-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-425-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-424-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-423-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-422-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-421-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-420-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-419-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-418-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-417-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-416-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-456-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6084-455-0x000002C107A30000-0x000002C107A40000-memory.dmp

Download

memory/6088-75-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/6088-81-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/6088-74-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6088-237-0x0000000140000000-0x000000014020E000-memory.dmp

Download