3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Size 1.3MB
Sample261113-dqm3vsfx2n
SHA256 3eab63d900b6c93a0d777ad2f448468fcee35feb66b11d495b5da8b5e36f1ed4
MD5 506b27204aeee6b7e1491648a18ddf8c
SHA1 a86be5dea755be29b2af1b5bce84480e383f20d6
SHA512 ebbc4d46c2bab2549aa525078f21ede7d9886dda4d2fe16c4dc69c8d9aa041b8f11bb2498483a5c9e4f2320716dd200267370f6851f6fb5a616085954e4d56f9
SSDEEP 24576:04ZZQufMz4MMMMMMf8XB6D+InjiogsqjnhMgeiCl7G0nehbGZpbD:0EZQUu4MMMMMMf8YDtnNcDmg27RnWGj
TLSH
T1105517D195C38CDBD41A0A316474D9B7542A3F246B34A3CA2EB0F5B95ABFEC13F12816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1016	alg.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
5088	fxssvc.exe
1752	elevation_service.exe
5604	elevation_service.exe
5160	maintenanceservice.exe
5824	OSE.EXE
4112	msdtc.exe
4236	PerceptionSimulationService.exe
4448	perfhost.exe
4568	locator.exe
3884	SensorDataService.exe
884	snmptrap.exe
4628	spectrum.exe
5740	ssh-agent.exe
2488	TieringEngineService.exe
392	AgentService.exe
3136	vds.exe
5212	vssvc.exe
4800	wbengine.exe
3264	WmiApSrv.exe
5788	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fc60e1ca4bb6346b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114625\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4416	4696	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000785195201d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfbebe1f1d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b83a41f1d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ecd1b21f1d73dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4a608201d73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000088476e211d73dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ae6a61f1d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e37037211d73dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5296	DiagnosticsHub.StandardCollector.Service.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
5296	DiagnosticsHub.StandardCollector.Service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe
1752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4696	2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
Token: SeAuditPrivilege	5088	fxssvc.exe
Token: SeDebugPrivilege	5296	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1752	elevation_service.exe
Token: SeRestorePrivilege	2488	TieringEngineService.exe
Token: SeManageVolumePrivilege	2488	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	392	AgentService.exe
Token: SeBackupPrivilege	5212	vssvc.exe
Token: SeRestorePrivilege	5212	vssvc.exe
Token: SeAuditPrivilege	5212	vssvc.exe
Token: SeBackupPrivilege	4800	wbengine.exe
Token: SeRestorePrivilege	4800	wbengine.exe
Token: SeSecurityPrivilege	4800	wbengine.exe
Token: 33	5788	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5788	SearchIndexer.exe
Token: SeDebugPrivilege	1752	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4332	5788	SearchIndexer.exe	126
PID 5788 wrote to memory of 1584	5788	SearchIndexer.exe	127

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_506b27204aeee6b7e1491648a18ddf8c_amadey_elex_lynx_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 484
  2⤵
  - Program crash
  PID:4416

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4696 -ip 4696
1⤵
PID:4808

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2752

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5604

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5160

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5824

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4112

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4236

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4448

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3884

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:884

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5740

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5212

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8c889261f216bf418c647530ea60de1cc95fc6b0b9f2fbc75dac5b3ccc69c09d
MD5 8301f37f9280a676e7aa7d32ec23f529
SHA1 a036c3f7019f111fc0d79007bde36fa0fa9b74a9
SHA512 775baec61551f48de5ce2562f31fc378bc930dd6d9b097e3c16fe8a08bc1cfd44c1ab27c394ef22f3fe19d9157761a19e70bed57e2ff69cf049577c922c97ddc
SSDEEP 49152:fb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSDmg27RnWGj:d3q6mjBFD527BWG
TLSH
T18FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ac230f0d1364e7eaa95de88693de562b5d83ccc000ab0845fb3d91ddd703bf86
MD5 914ff6399624498ab0758f97825c867a
SHA1 eff6b0ee36ffcd75a62b1976386ce7b91075b9d4
SHA512 3a7c82f7d51a43a89676f063d5238c287d4741e75eda0ceafae183ee33b4243c43ffae3eaee33f03de758564fc4a305e64ae5a710fcbc0bec07ea12b99c8174a
SSDEEP 24576:IXYfDtczAtsqjnhMgeiCl7G0nehbGZpbD:ftcQDmg27RnWGj
TLSH
T1DF650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9d7f57152035998ad57f12960e0e6bc32a65add9133168370c84453cab5d7e9c
MD5 7e76ccbdf2298a11126fb0c37b09f1bb
SHA1 bf93cd79e6739dc1ba6209e4567bb35b185b13d2
SHA512 31a30865e27efb6462cc0e34a1b716ce1ffb5dd6f6473fbc079aafe51c99f23101a319855505109065d2cb691e52e30d5bca4765e2a4cb1285a7f96da8ad4b7d
SSDEEP 24576:T0Le5ji0hmxhrMWsqjnhMgeiCl7G0nehbGZpbD:TPji0AzbDmg27RnWGj
TLSH
T1CA859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b1b7055c707cc50e9871dfad81d50ba2fa22ce2cd8df30d02bf02f3279bb286a
MD5 a1a217620ee4b46d8cc546b3105cfa22
SHA1 5dac2557e3369da92ac0fcbf4a17dafc9c68111b
SHA512 a854935a69fcdc7a341aa26ca48a40d30921559ed73e545f2b03dd7e48579f30a11c5a8c20c1dd52bd4db122aa40c95cb8be38185e340aa7321fef174a9aa137
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWj6q8wyuEsqjnhMgeiCl7G0nehbGZpbD:n/ezSC6vUzPv+HjyXDmg27RnWGj
TLSH
T1BC755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2d3a43bb71a04aba297a91fa9cfe166411e3a893c108a6ebbc5d2d545405f3d2
MD5 afd0781ef97dc85b4cdeac8d48a3bcdb
SHA1 0d808b4f393143ac4155d920ca37bd332594ea07
SHA512 75b4729bca04636e29f716e8fead00e0046eaeb714cfe3476df43891e731a6ee052e6e893135724f34d52064d63615e00db3586ab6ef02e52da3105c3b3bf450
SSDEEP 24576:OVbqPb88hv/l+BBsqjnhMgeiCl7G0nehbGZpbD:OVO88hXl+7Dmg27RnWGj
TLSH
T192559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1a7741d583568e1e3c97c16957fd8c741946fb039b90091ed90117e245bf54d5
MD5 d43dc4e729f749ac8cacdcf669290f99
SHA1 a62fdb8400f4d9a37c4c1c22ae5c5daf58d9397a
SHA512 2a2a5ac19287c960de1b5598bb3abbd5e1a378776e557234c36e2b4e5e08ee0fc49de8618cbf9b0ebbac351a3a8c4d26dfed39abee60e1b089e904d788f317d4
SSDEEP 12288:yGaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yGasqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF874C50CAEA7608B5C3E9F11EAC177E56982008436AA37DFDE5B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 f3bcc56c34b3c0652eabd2d345592afb11410eb510ce001a7faac40f201ff72f
MD5 6de9d671c5eae93a4e7774fae9669ea0
SHA1 e778a2947c4fff565b40eb2357a179d569d69e5c
SHA512 3cd56a03935b085f63a7235543df50d3a60ca6e607e5cd68aa138b566784cf9d24899439d5ef0fe02804b909b954a17dd69be2ecdbcab3e9a1e30331a1af2a83
SSDEEP 12288:YeBNUbTVO86UZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:YJIUZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15965CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bee85f2fb30c786a95bec6c5a4c939e6e4930c6e1d6e71e58415d3abcaacdb99
MD5 a454fbebbad39e7d80bbfb876452f871
SHA1 69a85f3fb287c3a7596223a1ec122320b0710bf8
SHA512 3b947a9ddda5d6b54fc3e10e1d8d81c9b291cca4a99f2c3764d839d67998a9217649fb75d3a882be921fd003424294b0e9bf060e4ed621dc46a9ff97a3261038
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THI:qQvGAdlCEL8c/WRNw5CwD527BWG
TLSH
T158266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 5eb35eba756ca78d20bf0bded41e5381868dc11e6ea8029a69dd43462c87dbc0
MD5 a8eda99ea9db5b0c9b739048fef21a31
SHA1 9c8e67f42a6b0620c08419b3f5471cda6e57ab51
SHA512 cd1345a7c50d202a1d286fdcf0a605f53f62376daafaed99fb007cfd71c09c080242f802b528225fe9e3334f49f21ec530f60a178a6b3f537c3cf08d40057a72
SSDEEP 12288:8AwSfxL/2Dc3mDLLmt0LDQewsAjXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:hfewsAjXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EA75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5501d3cf14aa30c71d9d1dcc3ae36e620e5ba6085f46a937ec72579b1ddd474
MD5 624a78426d9724e8467887ade6cea151
SHA1 19884059b8f2da3dd06bfa315d38a8ea6a7a3395
SHA512 78e5eb2d67b29785b5311ef61230e529b6545d782c245d06f04f94296c73f1cfe8f7783b8631d65873843999c45d24bfd230c6b83df12f71ba9b3d2cb416f12b
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjVQBWG:sUEtQevvqc2W1cpV20I32aB
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8ec23913a45a092d1faf9106175607b31d81481291bcd7ac0ff02e883c1f9686
MD5 f6e13e3a12b14a7b6de554d91f396a17
SHA1 c20484a437c6378f03124a4b6235f798f702e446
SHA512 5e62cf0849e9127d7c4abd7544e4ffc001a042b14d89c6abdab1130109b371e7f76d6f7a278e41298e6ff40dce0f1702466be53ba369c67218d194caa4e1ecdf
SSDEEP 49152:pCbRquA/m2yL5zLfFiV+XenmE3/zLDmg27RnWGj:moq2VjnmMD527BWG
TLSH
T133D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ce6db13a253e49cdd523f81f2692821e1adfb6ecf1f1deb8b6644b1c27acf4b9
MD5 d42462bffa9745c08ff127ff9071c14c
SHA1 4a120bd44ad7a92bd23c1296b5a172b3234a882c
SHA512 99e631238e0e7842ba6d0b9ee99f7e309a299d213a53bbe45b883a636c7d6acf24156205828cfdeed14b87c73ae8e02275235e9b69598852b3f346f08775172d
SSDEEP 24576:CAhGL6IFoiwtA5l7S53wsqjnhMgeiCl7G0nehbGZpbD:CAM5Foiq5cDmg27RnWGj
TLSH
T1DB359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 31811dbf76216cdc320f6a4d771a9455a436e86827148fd1e75969a0cf4ea9a1
MD5 4774ce0286833c459a9ab63a24538271
SHA1 3b466f5c8f691eea10c22946f291e188e6ee85e9
SHA512 adb3c7c62a1d66f178905f9aebbbee8b250b8952ff6fb491a41fafd56579b23535ecde1b3efa2092a39240472f0a83230d3d4c5f83212414024dcedf79ffe4bf
SSDEEP 12288:qmw5HEjsChNEBFgl0WDm+CkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:jwuROWzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10A65F14A76A81CF9E9674538C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 daf22a80eb2fda2e443c89c9283554c5edadffb7f27470318b084441665a3db2
MD5 d06476a3b2ff294c6989ba1d21401ae7
SHA1 b84d7e668b23e16d47d7bcb565d7aef57cc95718
SHA512 02584aafd94180e10f6b6ab0bab5bef37712b6a25cd84e0dfca4e979da495c1bf20901e54dae1c7b4f315ad5b7cb5c60d3363538909645c91efa2a6cede2e708
SSDEEP 12288:VyZ1IynXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MZuOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C5512AA239820F9E563417CC5E5D609EB337C62673003CF166659AA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b0b93a21283ad4c08f9af106f2958ecccb6e02a1de89d209fcc56834026e9530
MD5 58883440d6950ca7feca627f7283f2bd
SHA1 c18e1a598eade97829a825cec7142da0594e4159
SHA512 a30fe0787b664794d9a271ebc039ce582127b77baccd4c17d0ea5818a07d8d31c805e81a07cf9f93c612603d8b8fee4f8438077b2036abb3d81bdb1b9e2fab5e
SSDEEP 98304:pQRQyi36YOcPDLvw2gAf+PN3ZD527BWG:AQyiKanX+PNJVQBWG
TLSH
T15A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fdc472b93a3f39906897ff4af1beb77da2859b258fc6c7dabc080427047bd957
MD5 03d6b72b65291b1dbebf57e8c8147b87
SHA1 344034bd290cc5bb666ae642c257f7c32559c2e2
SHA512 9b19be26f71fc9b0e01df95f493ad829e4a45a1f34b42c621aeb85c62c2bedbd6bf73acce077ea39d85be8dee713652f3dcd5f9cff23c7aae82454f243797fef
SSDEEP 98304:NQRQyi36YOcPDLvw2gAf+PN3ZD527BWG:kQyiKanX+PNJVQBWG
TLSH
T199667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 78516c6234ceaf71c6a735249763810863191af1327513b0d646b20f7ec0b881
MD5 5be877a43a4a9b7d70401d3d5558583a
SHA1 ffb063e80233f95185668bea1dbf778613f077e0
SHA512 d2b6817de281e0d923ec8ad2ba257cdd7e800464298c8ef439fbf41c7b6b1900eddad80e823bd91ba6d58db7a4f01413b90aa464c75c374b3f20093ab7e107f3
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0+sqjnhMgeiCl7Ge:U68Qg55nhkeWu7PNU3/bDmg27RnWGj
TLSH
T123B55A33B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6cbfd9cb372767b2d2893495b803259c30ea1877b03195bba61d89edb4cb0266
MD5 84779ca283b49b8cc8035e67054636cb
SHA1 8aa93b7ad66b2c74e68e43334f0234cd51216e71
SHA512 c41785785876bc6cdb0bf6c243dd00a89a980822820e427532f8d2ca1ee94a981c8839adf29fb3b07b8a591e6f78785ce43abdce13f0e72d88ef09af019c9c97
SSDEEP 98304:ay5112gYy5azzVvU69nLKnhZuD527BWG:DLIHRWhEVQBWG
TLSH
T113167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 599d0590f7b6a929d954ba2974bbd1d14d6a0fc161ef4babf34d2ffd10ce1888
MD5 641bf2e64e5a219060b154c58af6c925
SHA1 40ffdd49ffd2e730208cb570e7d701235cff3c8f
SHA512 4f45e2ec4daa09c836bfebd240f1a80c8567809dbafec22bdbf87d5a79ab4d083f02a1827e60d386f37ebac5325b0de0dfb49b3e0b5d777ee63b0ad652caa115
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBDmg27RnWGj:mu6JmIxd2dBD527BWG
TLSH
T133D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7b6972fee955eab73c1d00c5f9ab02344648387ecb4eb41d078a158e3008880
MD5 bf703c8a0d81ed96b63054d2125ca305
SHA1 b31284ae9077df28a821a6735af5f2ecb9c9fefd
SHA512 08c8bb6c67578250f86803dc95849dbd39f9e13ed93c63278e08ced9dafe4ed80f29f64fc8fc66193a03db3ab4cae13b013a4b8f8c1c91fa9ece3a859624e393
SSDEEP 49152:y1hpsNoJpF1A67U44CwH7R4x9Dmg27RnWGj:ymifPqRMD527BWG
TLSH
T1E2B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e2be73c11a3441f176f8a3c9028e05612184c562a55ab8efc7781ad827c647a
MD5 672027b5562f5a6827a4bfcafcbd164d
SHA1 54260ae581f86b3d554fa2852d905598f92929e4
SHA512 6af098977a8c5ab112dda3f7a71c808d87f41331837611512b9fb3987dfec56d1beecb158b0f0837ea0f7393891a2afe7194f57682970d68beb40bc9f2415243
SSDEEP 49152:9SuZQIY0Be2KkRVtOnks6NMHqiDmg27RnWGj:T5dKqi61iD527BWG
TLSH
T1B9C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 92e77fc088cab98640b6cb5b2b20552fcf8ad6a4cb96e693fd0999df37243e4f
MD5 c89d9052342afe3c6737bcca1af15f4f
SHA1 e4d338f053024a2fd6c788d8e829a5c09cafe78b
SHA512 ea7ea8d74eb13af37025c051a441ea532db2bf94e99b64f08a381886e33df8538e48d11b39122a7f9c7f8492b9ed61a09405d1c2c4e74a7192f6a48e07379dac
SSDEEP 49152:thtSn8EApI0figjgiDn0AP5wRDmg27RnWGj:8X2iWphID527BWG
TLSH
T1AF95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5b4149c953767abb17a62fedca8dba25715dbcd3a55dc19639ce6830b3033f34
MD5 c419f2af3bd9797cd31cff104e27c1e2
SHA1 de0bef4dc756a38c707afe7a80fc5e0f3a098a55
SHA512 54a371c98af64ef84d0821adfbb4d01ff2884f8ea823228ea7330f0c41a471656ac4929b429dc4d45521985096e54ad4df6ec8ce781942fd726f56bef62ade1d
SSDEEP 12288:aSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1564523BE965C41CAE92648B5C3E5F14DAC073E57E92004837A977CB9FBF24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 608ecc6b5180029339b89ca7dbbd8eaed6f7856149348de8e19df3ff6534e049
MD5 6965c9f4ed2ef5e9a6c5d198f4a9ca75
SHA1 1830df0231dbebcceafe28f4e4b74a5bd51dad35
SHA512 9e36767054543e7f67642deca4df5fd01d97af94ce22484ab5f24b8ed105fc348a72a146e038e38aa960a0adf79079de258aa431374d07ab1d1ffe4fcac4f68a
SSDEEP 12288:4bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1274523BE955C41CAE92648B5C3E9F14DAC073E5BE92004837A977CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ff424157cf5d2af5dd513949144af1172c63e861fb3a6108d7f9b526dcba162a
MD5 c6ba76730425071b34af4aeb0e8d14ba
SHA1 cf8636e8197827f83fe1f7bbfa4c4e5cfa719f58
SHA512 3d687684bf16741dc1fd36419346d283922ddef29b2fae2326ca5a34037a7d1f263dc57240d3e3fed027971f357c25b1fb1951f81b69fcf6ad6d69821752a0d4
SSDEEP 12288:rxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE955C41CAE52648B5C3E9F14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 236bd36c389217a13836495ffbd1752b0784e585f29e07acaa9132ba64be1f76
MD5 bcfe9d1aa2dfd21f6f058ff9eb70efe1
SHA1 02f3e9da738684ba1e9045d95f8503b8cd788fcf
SHA512 70f556d002b6710164071692246464e2ed2bc6212dd2be856b8cd0a5376676dc1bd4717a17de06ad89c8c68a8a6c2bd76084df3974feff772f18f8155b0b73d8
SSDEEP 12288:PVQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13445236F575C00C6D83685B4C2F6E11DE8237D96EB3005DB6B532CAD9FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 73f3954a982b66d87ebf5de8c9d8578272916d54bf3d095cbc36396c27987b23
MD5 94fe9479f7e0382a70816db23aa254a8
SHA1 c5e53589fe3546bae7a45da6fc32d7dbd5efceda
SHA512 feaa69aa0d52a2870bab95c702f07ba7d67ff7a7c93716580460200f877ad98ff0b168ac8d6a4d9aa70ee51c2f32f34ce89b1b1aab8f02a7d72f7a719574a2a3
SSDEEP 12288:t4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:t4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BE955C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CBDFBF24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b167c819977b8a0fd1248dca90955c8c7f479a70cfb733ac5cfeaaf5b9e0915d
MD5 7ddac70943d9cb34a50d49ec94229995
SHA1 dd207a0293397d5f1d0ff23c9470a8aff4cd9904
SHA512 3ba7b5a3203f76572348236f24080794e4fc6b9ebb82184b4b434f70527cb0d2ee1d8d332d284c5073f8388726115905c60e1de518626dc86503565c8e2a6505
SSDEEP 12288:/PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BE965C41CAE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBF24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 68130728e1317bdca0b1c5a4021fa793b5d2e0b259dcaaff8e9d3514685cf703
MD5 17984bb166fe746e62a38a2dc2af6667
SHA1 e91b2ab311e2dffbda1d0db30f63dbe630cde52a
SHA512 6703fefdd1da7b7e44bde8a2db501e2d5eb256d304f3100878f6c3a67322a8a0feb1ed55046f3a17bc93457459e7ef698b7c493b794846819c92e363b62c40b0
SSDEEP 12288:ZjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA4523BE965C41CAEA2644B5C3E5F15DAC073E5BE9200483BA5B7CB9F7F24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 189636813e0062517802bcd8aac71a467e4c550eb09d8a2b5a6782a7cff0c140
MD5 7b313d2c5107f994c87e36dd5142127d
SHA1 251bfedcf5f99a536359c6fede2e0ba1bc303a83
SHA512 d4bd2fb0b65c519ab8bfc8731a7c80db2b36ff7f87319ce17b14a0bb63c8a540f22beadf51654cc16ca58c985cd76637a54e484dc73ee2d4f49e81537d918b0e
SSDEEP 24576:ZZM3zFVSO7sqjnhMgeiCl7G0nehbGZpbD:ZZM3zfDDmg27RnWGj
TLSH
T1EA6501A9B35018F8EC63813EC965D90AD5B37C5A4B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 dd8078d4c99ab0bf7ae932d00ac171347d0ea5ddc09456b1c4ca6022919c0af8
MD5 39c33a67e8195ca5ff73366256b80e8f
SHA1 2cc95ecfe4886d94eb31b661d3efbb37eeda076c
SHA512 f67e2ab51720d8b5056dba4a3c16320231be6d65499974c55afea113acfdf54569ea26b416b43236c32e58d570fcde9a464c7fd3a321f6e13afe20015e7c102c
SSDEEP 12288:reXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:resqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BF955C51CAE92604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 8394e6c5f1bf6c7c32c258d09c7982e3a5318a3697c06890a877aa726a703c77
MD5 be8f9ad37895ce45e6634c17bb652e09
SHA1 0e946bf199ffb28506fc995c5c33b9d27e4c67b0
SHA512 49082e15eb78a8adee3b44ce7b4280f97e35aa68e898743b76b67a458c66766692fa0166131f891585cee2915f97478c90e3faad4014b168ca956ad1b7f2ceca
SSDEEP 12288:RqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF965C41CAE92644B5C3E5F14DAC073E5BE9200483BA5B7CB9FBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 aa145dfb37867efe253d0e0c2ab966a1dfb64a8194b22c1a78a6be43e7397b04
MD5 610ffa29cb4d3babe3c3dfcff420a583
SHA1 21d4a12563dc0b139fa8145b1527791b57d58e9d
SHA512 947d002d99858040648df4320ba6b1e586bc2ec9e85bac4a1d86f080a64bf4c61a02d2014ec157dd439851782c4e296f3816cb408951f180d39bb26ff68a1d17
SSDEEP 12288:UyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NzynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E655025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 6b81ee2d7723e1251924986f4668531ac49663eab9b53dea42babfe5b453ba7a
MD5 d2bff52d7ee7acbabf84f2fe6ef83963
SHA1 e21d333d0ec6d5d614c0b5a704572ce1db877f22
SHA512 1c3a8cee5433c1267374917a07ed2d4cb8c8f366d084fd0fda7987dc43f7afd706d89251a00736584604d9b7ee4ce6f42a4c62d8c0d5fe305c2b770f9cc61bd2
SSDEEP 12288:4eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BF955C51CAE92604B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b1fc402ae5668e7172a1cea77cf10745bddac3dfe3ac4cc7916d01af2ed83fc6
MD5 9e47156d8b7d2b0eeb290c9c3fcac8ef
SHA1 7cd8481920e0d9e52a8d066ffc34b462206344eb
SHA512 2cb10f5dcce251cecff3633d964c1b30e9c3f0dbe9cede51d64943544c61bbb3e3576623aa0e109233ae8ed2a4e0156609d47d1bfd9e573b156726120b3833af
SSDEEP 12288:EeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF955C51CAE92604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 e3a94183f4d7e26423c73a6a2d57345f43509e5147feb9a5a515013b20e4841c
MD5 1c1567874edf24bf965fdd21ed1d10b5
SHA1 cfe7cbbd97c69f0751cdb6736f027013fd75fa86
SHA512 3a9f25be7d5f5cca628f6313ca99ec9381d4a645edafa4785e26f1c9e4914403b4112447a0031c1ee4ced5ed40d83d41e7bda58d4b072d84a95965a8471c30c3
SSDEEP 12288:pyPz5L8nXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IzynsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E055025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 fa0a329539fa6b85e7b10893c406d9695aaad8d6bd9eefad445ea27157da188f
MD5 475db32c969d56eec90a2bdafa653640
SHA1 8b0930fdada993aeab4bdb21a82a85484a2df927
SHA512 923937bc8d938ae584e8d5010c6472ab0dcdf0475548c577f44eb0f6e266a2b202c6a80b334d0d0b50f30a736ebc96a685a77533ddc431e80a10195fd504c5a6
SSDEEP 24576:2T8aLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:2T7LljgDmg27RnWGj
TLSH
T1166501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b3435f6125b43f9648bd85398afc758c3febb836ae748f52bfba6fec23025bc5
MD5 1870e94cb9112c0739f90859051aaf7c
SHA1 f07140507b158d59867b966fb81c13b9074383d7
SHA512 29ff68f0c7856cc6ae3aa8bfe2876eed2299aa661fedc150a3a20395395e89c8bfbe86c39d31446f2a8428baa4738053c9e3acb44c61442cffa24cc1f5063acf
SSDEEP 24576:s3rd9CHKy7GZFsqjnhMgeiCl7G0nehbGZpbD:Wrd9CHKyaDDmg27RnWGj
TLSH
T1D275CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0b75a1bc1b3405e0bd262b895e8fee3478ecf3cb39f8a61e2e08d880f9058411
MD5 e95c25c70af70560728ef344e5f5c9e4
SHA1 8d138c753efe681b14de36a75e80ee4e13de51f1
SHA512 4b6dab3f4a4115b0bc36a6431d76d76aee6463afb8c89de4c6361fb7aa5f1781f0786f48e4ca807548608bf5082f9558338c5ac2b23a54237ecd08f430ebc7f9
SSDEEP 12288:RRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B54523BE955C41CAE92648B5C3E9F14DAC073E57E9200493BA977CBDFBF24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 96960ef5f82ceed337cd84baa327f212732db5ba1e4bbe5c6f44cd3ee07a73a4
MD5 e554827cb0f1c1f4af1c02bb0622b6c7
SHA1 7d8194028dd881d25aefc7c0f58374585ac5be2d
SHA512 96deef78f6ca685ba6f41da49bdf22a6ff8fa71e03e0de8e06b8282728d0bc9f99e2c7cdd779819b4d7d745153b2a1f95a95a541930b9857ef0248ca60f4ff6f
SSDEEP 12288:zHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BE965C41DAE92644F5C3E9E10DAC073E57E92004837B977CB9EBF24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e4e961344da20db28fb41b43c7784ba3a3587257935c3809af7e292ee0dc122a
MD5 6112197383ad04a2fe5fef7ff896882f
SHA1 c6ce7e2c7b46b4b0e4c293d3e0a898f42564688b
SHA512 f0a5a70e17316238ade3f9be5298ff9fc70a98ee1f7e46fd79e3bec0931ce077e505303b8851b69f6cd8753fae4aaa1a73061da5f6674802dbba0c0be048692f
SSDEEP 12288:3sXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BF955C41CAE92648B5C3E5E14DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 827ae5fd0a323ce62fe4536f4b2763232db3d82014ca0beed727e890347833e2
MD5 6dc60c4de047dd9de15b14b56ddf5a6d
SHA1 64a88778628709527cf949f125faaabe186bacbb
SHA512 e645b94a680054b1ad9e106ed8976c1f3ece94d99f2f853f7a3148f82e1894f46d5a8f3356c9c21ff380b14ec4b4dc0c37bf3993aa82b171a5d973adab94d9e7
SSDEEP 12288:dpsfOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11755015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b6e5ec3046f5158e08594ebf8c6232171cdc6b249b1597f0e09b340778d86b15
MD5 741ebe840091fc24ec8ef5fbfe591345
SHA1 5d3fe49087b062bebb536b34ca9f89d2da77d0e6
SHA512 c0ea7b776e6b7f23be61e5d48416190c3c19c36ff648f0077921bd72fcbaa45f14ab3d47b81fffa60665273b747f5c804a57615f278c31d7024cb790c64234b4
SSDEEP 12288:CvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D345237FD34C518BE57659B082A9E12D780B3E669E204483BA4778FDA6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 106f8a26302cc760b92f7893edc30640e700747c1b5edb228530cda6c2dc1e02
MD5 121338ef148095bd93ec9ea484626edf
SHA1 8983937c2fbc58ed34797ace94f2e00fc8245305
SHA512 89195f384df83a91d51967102c65204cbd9cc480c09e1893880d696d6fada95339f4eedfead2ecb5d55493880ddb84705f84346b5981ae48434ff7c4170cc5e7
SSDEEP 49152:Ta0h2GEkuAe73q3pp46zwwQVDmg27RnWGj:Ta0hNYG4JwiD527BWG
TLSH
T10B85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 06e903374cab3ff929909dd60afd58608e5e8c28d043589667f7b15dc59bd443
MD5 30458f34f937842bf0376726bce05e34
SHA1 d9f902ff8355ebe9da2c70cafe29a16029e3c0af
SHA512 6452d1974a9ee2bb5a80f7a797fd8c9c13056746f541b62f7638bf08d9171a79f7047de2fc5964d6b59d6191c01099dc34e83b7f485fa8432e7a98ee3ebf64e8
SSDEEP 12288:2hbHjfX1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2hbHjP1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155127E16AC20C9E572A1BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ac461f1d57ac5d042307ec7a609e0d2b31e1e67b0d6ee7677148f6a628778719
MD5 2994511ba3cc66ca326d8853238dcc2c
SHA1 c30d9caab622ffd248c4c9269766c705484c54b7
SHA512 a456ca261c2ddd18c413a188d1b7808a3fa1f17397fb7f58cfffb2be56d2b2c1f865b0e5990c932c7ae4acb75c897516f2ae255e6edc2272dad4dcde4729e6d5
SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/tsqjnhMgeiCl7G0nehbGZpbD:DIgnaTk46pBR/RDmg27RnWGj
TLSH
T17A45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 bde380cfbb971a4dbc0cf6014e7f5b83f7e6d45c84d7462bc5e9238d4799d0e2
MD5 affa604b2f161343e043987cb2437323
SHA1 3d10b178c14e13d3286df8c4e30dcc212b04fa02
SHA512 c07b5f24241a4bbc88f5f0a2217a38cb35a799d414f8d852dc2417f4223c53316dd92df68fe181c0663d2b015946cc1c4645429af4209f85a598e68d27defa83
SSDEEP 12288:ojXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ojsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BE924C51CAD93649B5C3E5E11DA8073E56AB2004D379677CFDE7B28E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 3b3a5c68af828b5d8d355ea1f4d7c921ed2a5e4880f7c906adf9ba0006d7533f
MD5 c3b374305cc86b42343610bef2d956bc
SHA1 662b441356299f598a9c5b6fce02f3a9b08cc55e
SHA512 3baad020390635572df98ebf0c75f546edf9eccc32b80795e6b0f4c26b36e03bac3149d979585a158557517022a42347f6a46c2144e7a7b6e7b2581537a9bc3b
SSDEEP 12288:AObIA4LWOsvAYFTkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:9AL3UTksqjnhMgeiCl7G0nehbGZpbD
TLSH
T184750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 4af2d3756cb6c79ff2c3c590533f44f3545b91436407d613861aa9f7cb85929f
MD5 48a6e8ccf8eba4c323ee2d483a485305
SHA1 1cf27360c288c7c3edab5355e869c1f39d315728
SHA512 c12e6bc0b5be1dc4020ad757ca5b8330c1b1f0dda6c9e02eba9aa650075421675647c92eb64ed8a275d2f1fefd8819a2731a88f942feeffdf79717a9321ca4f1
SSDEEP 12288:SpFtvOIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mOIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB55022E33EC10E9E536A17C8692D20DD6327C66172117DF06D184BE5FA3EF84D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7f8ef0abd90a8476519a8a2e0690492c239cadff7732b9c5c5f0bb61016ba077
MD5 e26c954f9d8ec7511d18859dc5133a8d
SHA1 0f646ffb7c18b59e013aaa772a6d55be51b363f9
SHA512 69830b9f1354ff4d253b464d690ebca48e0a91f0219482087d98f0ead8447282e3ca1298f8b98cd018cc72043b418b0b7fe58d6a9937357ff78c2217c4ec1221
SSDEEP 24576:z7NM9YqZqmWMUkPjZM48Mv6bEhsfsqjnhMgeiCl7G0nehbGZpbD:z7cBWMpPjN8DbEhGDmg27RnWGj
TLSH
T1EC65AE2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 fa344c519ceb2d58b8ab4983e3131a38ed964dc5ddc735bd3949c7d2e0a19a54
MD5 11b8c8118e817d11590fe193520d440b
SHA1 e22d3c953595197e20984e04fef68693cb3927d4
SHA512 5c391383f78671aae124e2eece39dad9dfd64c26358a4095b133c4bfe5254327389d2a44b175e7be275240fd0602028988659fe4854efa1e79c44f9c2490bc30
SSDEEP 24576:WW6BApg2YuyuNDYTabvcdvNYf8km1NsqjnhMgeiCl7G0nehbGZpbD:WF2YuHNETovAvNYf8kmjDmg27RnWGj
TLSH
T103857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 90573fb955eecefe7743e63add599be14c53a8c4b3d149ca4322b5b10080c85a
MD5 a32c21a0ec87b0d1918832ade671769a
SHA1 c807e9d6c62011d2c4adb5291940dae13ffe24b6
SHA512 a6e99eb6da8c9ccd9272e9f4f265a5c46528f1dc413c716db32e9544226eebab1e9edc2fa499d98a5362ade5ab7c3019d2642cccfd8decaccb070efa20e1ae25
SSDEEP 24576:PAFs06+Omlf8NXEbTossqjnhMgeiCl7G0nehbGZpbD:YFs060loXu1Dmg27RnWGj
TLSH
T19F65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3ba3486a5c23d311af62bc2a83d012e173e5804d9e1d5eeb5f2303d393e676fc
MD5 17c2166271f79804b42de2f4c6c10cd6
SHA1 24b5c41d3c4b4c81e2609277c84a24dc027317ec
SHA512 cbec7f49e408a8c08a64ccf9d8fcb6ad791277d0b249e0aa3d4f7097dc4e0326aea9e1e95bef3f9605d2075bf4cd63443ef3ae787b296f947939dc25d628d23a
SSDEEP 24576:EJnJ5D3WXhsqjnhMgeiCl7G0nehbGZpbD:EJnJ5DGX1Dmg27RnWGj
TLSH
T18875E13DD2A810E8D4B7C2B4829A5756FE72383D2F2169C728B4D4357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 1276e281fc937d1fc9a14342de9b6b53a4efb4c5aebdca3411f53e037ce90aef
MD5 60a4df87a09bff99b0e3d1487db5647c
SHA1 b3d38da7e869a51d109cfb59fcc7843354ae2e85
SHA512 2aef5309a99d37cd60fb5eaf545c51d03427190ba53ed4d684b9bbd4c9db89a706dc9d02710d6f6fea3c54eb24eb8f1ab8c56d020d81344c692d29c9d1023efd
SSDEEP 24576:yEPghm6/7IIXdwcXrif7qQncjlP65i3VuasqjnhMgeiCl7G0nehbGZpbD:Fg06DIKdwc+eQnSt65aV/Dmg27RnWGj
TLSH
T18A955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 546979f7ea71e422143e8c4a2e110961baca54b73d63e576576a026c04621ad4
MD5 fcfdb3a230c6457369b59399eeb10734
SHA1 f68b414814b624336122672ff4131e4c59f3afc6
SHA512 777c169145817770a97dd9995310bb117ebb4a9aa356d596c3004123be15ee07a5fc380596a6fb49852b1fd569024b88346e73072ec92a8da8f5dfddb2e47c55
SSDEEP 12288:cEP3RnyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XnysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F855126E679C60DAD536907D82A1C209D733F4716B2127EF2692C57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 1c5d352fa63f7e97566cf26bd5b61b020ddabea2131906d15fdc4611c97cd8a4
MD5 21343d87195b4024d22b3b9258ea8796
SHA1 fc40cf1f4a63d8157410d3b5d195656a918d01bf
SHA512 3ef8cab80733b83fcd95edfa1ee3f78aceab790a17497e5a2b32e1494d3768924759ae4d8742591d3c0113ce3f26c935fee25ee6f31c1762265bb5166370c10d
SSDEEP 12288:kjkyyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kIyysqjnhMgeiCl7G0nehbGZpbD
TLSH
T180551219639C60C9EA760578C6B3D1599C32BC319F2042DF6191FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c281d666a91554d90c8ce76963bd6d48726fcd9a1d851a5fc8ff48736caf2966
MD5 00c455cab5aecd43e32d4d7b19fc483f
SHA1 981dd312d7cdb1a28cc5dd6e1b613d439c9e4042
SHA512 afc46d4bfdcf47c7775c2ce4e5aaed487ce3cd53d682e7da3cfe507c57cac1542a8e46cceafee8e41f0011a006ca14bff095bc42c832a3a76da125c97c671a78
SSDEEP 12288:OyYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B45237E525C60CAE93644B8C3A5E10DA8133E76AB2014E775E7BCBDEBB24D44739813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0eea7bc603bcd826b7efcc92130061da189f310be8e962fdfc7a08e111b64007
MD5 0588c6512efb952c69edd0780a3449d4
SHA1 2fb43e591389455886e7db702d27494eb10ae43f
SHA512 3ddbfd80a1ac68091c6391b006ad0b423dd8337e0bd889590cbd5468c41b6f9eb300fbb441e22f207414b22eb4db3b01d29ea073941e4986b6c32818ea00e6fd
SSDEEP 24576:SQ9MxZKdcz9dw3HsqjnhMgeiCl7G0nehbGZpbD:SVKZbDmg27RnWGj
TLSH
T1F5557C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 8717cad87299b9ac15b742a001191abed9dd2fe90e5a7bd634450435249b2433
MD5 3e36458faf780969b713bd86a7fb0336
SHA1 63e96b822a1cc6e97b279d5095d512f15bcbeb3f
SHA512 6f14f6ac725b0ad7f2ffe1c152b1a19147172e413be9c3b9a89934a2b18e0346b8e676e74b7a4f6f3f85557627931351c98d96214419a12bdf24faddccbb2045
SSDEEP 12288:WyoKo2JRple9pWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:WyocDApWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10365E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c287f367a106f568f7c8d1cd2e95ff625570746914d2a522089616dc4a3a06e2
MD5 80bf3bbcf5feabb16ce005d3c3527372
SHA1 7b9f5d84a5616e476ad79203d69be7f8f53575d8
SHA512 746d2c4ba7f1ed88caf7e7a437ab2fcdf7a6eb1ba200e2090daab9c71e5b1a9176798712a4d079540d5249c58da43397e9056b446ebaf9d4e53687058a9eb741
SSDEEP 49152:TWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKaDmg27RnWGj:T0zuNIAD527BWG
TLSH
T128A57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e3a1b6f26dd37755e34a76c0668351a35919d96ae21847b2ee8337fd269fb695
MD5 5e27b5a26517b4c69e1ae5834a927512
SHA1 d3879e8b5d59d678b7151fa5f7343895205d0723
SHA512 146f3bda932ab9ce472ea41538a33d0e50177cb4de62ddb55be5f8bbf2ad31110212b4f0592acea71807e945b6f00460583022bb73caea4c656fbb7953a395be
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYzjMqbysqjnhMgeiCl7G0nehbGZpbD:XTDxR+N5YzTBjMfDmg27RnWGj
TLSH
T1A555B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-311-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/392-309-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/884-280-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/884-336-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1016-203-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1016-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1584-439-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-423-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-447-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-448-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-442-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-445-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-446-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-441-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-444-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-456-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-455-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-440-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-438-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-454-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-437-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-436-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-433-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-435-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-434-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-443-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-424-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-425-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-453-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-427-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-428-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-431-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-430-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-429-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-426-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-452-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-422-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-421-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-420-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-419-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-418-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-416-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-417-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-451-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-450-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1584-449-0x0000020372390000-0x00000203723A0000-memory.dmp

Download

memory/1752-42-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1752-35-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1752-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1752-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2488-306-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/2488-410-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3136-314-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3136-432-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3264-504-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3264-327-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3884-326-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3884-407-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3884-276-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4112-313-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4112-245-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4236-316-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4236-256-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4236-250-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4236-249-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4448-268-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/4448-318-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4448-263-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/4448-270-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4568-323-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4568-274-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4628-283-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4628-284-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4628-290-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4628-405-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4696-1-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/4696-8-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/4696-31-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4696-0-0x0000000000400000-0x0000000000550000-memory.dmp

Download

memory/4800-482-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4800-325-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5088-41-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5088-233-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5160-71-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5160-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5160-58-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5160-66-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5160-69-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5212-481-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5212-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5296-22-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5296-24-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5296-231-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5296-23-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5296-16-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5604-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5604-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5604-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5604-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5740-301-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5740-409-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5740-295-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5740-303-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/5788-366-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/5788-414-0x000000000CCF0000-0x000000000CCF8000-memory.dmp

Download

memory/5788-382-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/5788-398-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/5788-341-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5788-508-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5824-73-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5824-79-0x0000000000420000-0x0000000000480000-memory.dmp

Download

memory/5824-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5824-236-0x0000000140000000-0x000000014020E000-memory.dmp

Download