f04ff7941724d9b94b473d3bb05c3ae7015508d9ececfe2d63695edbacad327f

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Size 13.2MB
Sample260427-q1ycsscx81
SHA256 f04ff7941724d9b94b473d3bb05c3ae7015508d9ececfe2d63695edbacad327f
MD5 2155ba979b2101dd79ab92d3363a18ca
SHA1 1b89f9ac0862610fece6f7c028e2095721294a09
SHA512 ec681d0efa6f5936040703d546d87fcd8a29791c195f742beb470347e30c097acff0c676d16f17ae09a9b4808516fa255d9109ee509da5c01e5bfef0c08f750b
SSDEEP 393216:pAgAgAgAgAgAgAgAgAgAgAgAgAgAgAbAgAgAgAgAgAgAgAgAgAgAgAgAgAgAfB:
TLSH
T1CDE6527BA61D16D5EC1CE07FE48D46A7673000B3D7A6307130E6DE2B404BAA48F9A67D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1484	alg.exe
4276	DiagnosticsHub.StandardCollector.Service.exe
3404	fxssvc.exe
4272	elevation_service.exe
816	elevation_service.exe
4744	maintenanceservice.exe
4388	msdtc.exe
412	OSE.EXE
3280	PerceptionSimulationService.exe
3976	perfhost.exe
240	locator.exe
2020	SensorDataService.exe
1368	snmptrap.exe
4952	spectrum.exe
1432	ssh-agent.exe
3844	TieringEngineService.exe
4960	AgentService.exe
4700	vds.exe
1936	vssvc.exe
920	wbengine.exe
1860	WmiApSrv.exe
4144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ee5430ca14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000516111fb50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c2c9afa50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e7ac7fa50d6dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044eedcfa50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d5f4ffb50d6dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeAuditPrivilege	3404	fxssvc.exe
Token: SeRestorePrivilege	3844	TieringEngineService.exe
Token: SeManageVolumePrivilege	3844	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4960	AgentService.exe
Token: SeBackupPrivilege	1936	vssvc.exe
Token: SeRestorePrivilege	1936	vssvc.exe
Token: SeAuditPrivilege	1936	vssvc.exe
Token: SeBackupPrivilege	920	wbengine.exe
Token: SeRestorePrivilege	920	wbengine.exe
Token: SeSecurityPrivilege	920	wbengine.exe
Token: 33	4144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4144	SearchIndexer.exe
Token: SeDebugPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4968	2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
Token: SeDebugPrivilege	1484	alg.exe
Token: SeDebugPrivilege	1484	alg.exe
Token: SeDebugPrivilege	1484	alg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 3288	4144	SearchIndexer.exe	105
PID 4144 wrote to memory of 3292	4144	SearchIndexer.exe	106
PID 4144 wrote to memory of 564	4144	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_2155ba979b2101dd79ab92d3363a18ca_elex_karagany_manuscrypt_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4620

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4744

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4388

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2020

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4952

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2268

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:920

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1860

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3288
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 1624 1820 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3292
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2040 1928 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 81e61a480cd71edda1fd5a0b37f8e8c90a214004fd7f4f9e3d612eccb223b82f
MD5 5e3975679d0064ba7c10028ca94d7b17
SHA1 565d1130503f40b39b8404c08f8a3fc2549e1635
SHA512 007004cb0e6da1e229cd0344d212d7e5fb4fbbdcc2e715108f4e5c4b9ec812e523ecd3e6e041d1dd083111a8a66dce621c7c8107064012becbf78da1e29df535
SSDEEP 49152:hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn0Dmg27RnWGj:n3q6sjBrD527BWG
TLSH
T129D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e52ee9ffc923deb6915c2ee52adbd7a86af2704ef9a165a006911acec35eda3e
MD5 3268e8a1fc58a5656aede93010612601
SHA1 c4f53f0b448b2d686bcb528eab57237d4d0268b8
SHA512 7fa02da6f0b685a21d5edaf8331991cc237d91b0cc631026cc3a3cc8c421c57de35286d8244a8e0b93f419e7a852941c086cd99154a4b0b395501d36b1a5445d
SSDEEP 24576:WXYfDtczAjsqjnhMgeiCl7G0nehbGZpbD:VtciDmg27RnWGj
TLSH
T11A65F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 66c2956338f94227ac7880a08465e00a0c8b3d893ea2af63dd1a5065905b9905
MD5 f64036b1963c21c9457228191a8c76fa
SHA1 c647490fcc2d79878706f0151bb0e1f7e029bf11
SHA512 46471ea87ef88d4ccc6fe9eda06684d95aa78b8c7dea540bab78562c7672d3a7b20111e643523f62f66e98cec87157413df15f7560a8cbff3c680668fbc973f8
SSDEEP 24576:40Le5ji0hmxxrMgsqjnhMgeiCl7G0nehbGZpbD:4Pji0AjxDmg27RnWGj
TLSH
T166859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 70b1d11ae20bcfb1cdfefc4517894bb616d09bb45f2b17a88117f76ae0827a44
MD5 ac162da309fb27a74bdc765614b593fa
SHA1 0fbdeb6561f4715e3d7d7d2b76940441db79f48b
SHA512 4b3fa575e34b40c622468ecde6717d93a1fbe8d013f1360acda4e038d095d727e5373407302673e433de21489903b8401c19dc7988d519b8037b9a8047596269
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyu+sqjnhMgeiCl7G0nehbGZpbD:W/ezSC6vUzPveHjy9Dmg27RnWGj
TLSH
T14E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0913cc83f263123e1e92875b2aa190169441f67aab93e254119983627df19ba9
MD5 97cdb4fee93802c51f6f9d76b3bd5538
SHA1 c6148523c298c38fc4fc31799cd05e5244509a80
SHA512 4e363cabc34472895a55dbcea9666a4667c2a7f7eff95272246f802d0c0b7a9d8eaea518b185b438b7527f43a42295bfb27387707f22f1d7ec380c3c85816933
SSDEEP 24576:QVbqPb88hv/l+YHsqjnhMgeiCl7G0nehbGZpbD:QVO88hXl+KDmg27RnWGj
TLSH
T1B8559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aca40fba292e427e3eff44823a8688d1b40c9f2c8ab5c007988a6071aea4962e
MD5 d69a5fc9d0311c89eb685a26b1871841
SHA1 2dfde0cf249906a2454f2e2a64f314a915bf3c3b
SHA512 6176256ccf3e0fbc682acf818898212d956873638f44351f5beadc71e17b76e4148a802327256a787363192a68de89684723ba0ce819f52eb3b5cffd678a1131
SSDEEP 12288:9LUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9LUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A94523BF874C50DAEA7608B5C3E9F11EAC137E56982008436A637DFDE6B5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 5cf7a9edfae801793e645c905f2fa201545ef31d3c66a32cbfd7b929b0eab845
MD5 7dcec0df27c3a19f8281737e32f98ea9
SHA1 b10839cc1850c759a2be91428dbc5e428bea5a8a
SHA512 ef7e52082aa927cfe6538f000b58a6325ed35364dcb3de94e0040df4fc7053555a9ff229dfc92a6fef5f4e653835d07c10f5ab95f3a266b950aee825bb1d2882
SSDEEP 12288:ceBNUbTVO86U/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:cJIU/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15965CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0cf4ab3b1a34274c1a8b3005e4cfcc874fa46d40655edbd8c00b87ec75ab9e89
MD5 bbe904c45c37356bbdb37e9f3f02ee6f
SHA1 9103e0ff1d19eda4a1bd9f1912ead318992b69c2
SHA512 1c1eaa6dd9666fadb7b353552df9ec3c8a2e6461680fb284db678c167358c00022104152a6d420da7cec67f1356d5907a30a16186e76ba76be98216821d6c5e0
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THC:nQvGAdlCEL8c/DRNw5CCD527BWG
TLSH
T140266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 93f8b99b332165dae3047ee676b9d9ef288da72bcaa4c49e7caad4383d73f4bf
MD5 de3a52bab4e31280cde1b549062a1ea0
SHA1 69e274151362f8954b4adf959b0e0ddaf766fed4
SHA512 565bcb09560ac82ab085c4e20889793301ec0024b1db8e61bb4dbe52c0731a46c1d3424a005af42f5ee3121a50a6f4ed98ba78b05aeec5761aceba85988b7732
SSDEEP 12288:DAwSfxL/2Dc3RDLLmt0LDQewsAj9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:80ewsAj9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AA75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 112f38d31b0894a0c120321e0d187a00a03d4046a27e16ec80da5839ded01f41
MD5 627e770a9970ee7a13767d0a288d2939
SHA1 f18db5ecbb91c3c19336847f68e60948aa350cd9
SHA512 34d7d4acbbd115e0293d322f6b197733069135603e77f1c002de0ce430f8938aa01da68595218bef4dc9b03f7144802d48f43e281d5638f8a7d870e210cac7c9
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHZVQBWG:sUEtQevvqc2W1cpV2tI32kB
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 edb6be72de8e09a8fcb97422fe777bdeae7ddf5f76cc5c17361fa77ae02528fe
MD5 801e9e09f16b573b66d2ad57c07e19d1
SHA1 5e91ed8461789964edd3a611a89fef72c5d5c48c
SHA512 2119e45ed787fddddc496bcb8ef8137baddbe8a7f8a81989871924d754e086eb77453af128071e0333c1706b2ba24f4ad2bdc96212e1908ece9d87c81f789bf5
SSDEEP 49152:BCbRquA/m2yL5zTfFiV+XenmE3/zBDmg27RnWGj:uoquVjnmuD527BWG
TLSH
T193D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b58e31a03213bb950a6980ef44c5ae3749d6156884c890db525b238622ecbc8
MD5 06e55cab174589b44b709fec7543d74c
SHA1 e0d490ee87f787ffa58ac67ba257f51271546121
SHA512 d1b9962782aca1a6883e234d6e5025b4f99bb92abbfa3ae372b6e8992676394732dded90f955f92e52a36f85f5b2b5c12d3c257b2aa740303dde8b21914c0b89
SSDEEP 24576:PAhGL3IFoiwtA5l7S536sqjnhMgeiCl7G0nehbGZpbD:PAMUFoiq5eDmg27RnWGj
TLSH
T177359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 0f113773f5a640a3e1ee2b697dad2b2a4c71d25e315529865866d1a4c5d5da8e
MD5 89273bbe7d4c9a5e2e712abce440cfe8
SHA1 f40389faaf2dcf647901dd59c7912ab748118ccc
SHA512 b081cfb6ef8485396e82e1de07205835ce39d1a8ec8735bdfd71fe53ffc3bfd80890bc36fc8e82776c482b62debe484b7dee683b9ec2e7f066251234fe5d1399
SSDEEP 12288:bmw5HEjsChNVBFgl0WDm+CeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:6wu4OWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4d572ee2aedb5e94f6c04e7fa788cdc2c22f15a4565c4a8401d1e16b33d8d5b6
MD5 278923b2e00e9d3ef48486b2ccaf9808
SHA1 ec862ada8e20699399779b839ffdc6c3e257cf08
SHA512 1ca47f655e48d9d873386794d4612794ad8e377520595d0dde9cba512928a12d81a162c34939b84cb4f69fa253a48fce04459ceb8c03634025d29c8b8f5cbe5c
SSDEEP 12288:7eZ1IytXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6Zu4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B5512AE239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 839623afa39f2d524b6d4c10f4987d8b657d25515bbdeca6169bb4c9568f8639
MD5 12383f8c84fe5164cba60ef2152c35fc
SHA1 778f14b555a8034806b4eeb01ebeef958c8d6c56
SHA512 1f23b0d17eabf397004875f941c1233c9798a5f78cab06415697957cb87a033d4c682f275c697a59ef067df6ad9d30f7961868ab50d24fd5c943b6f6fea43711
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3vD527BWG:ZQyiKa/X+PN/VQBWG
TLSH
T15B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5775531f32e0deca4a5eef7277548f3424b74257ad263ef8f063522b2e642108
MD5 38445d611f03b8be44a87e5cf66a06b1
SHA1 fca9cb4dc7406ba97a96f989668c5c83c6054166
SHA512 a25cb69ea7d5bb5a7c713712553014b606101d27674119fb1f3a398909456ea73f5f886e8d30bbb3d14f75f3858c1863a693a44fb77488177067bbb80827eddb
SSDEEP 98304:bQRQyi36YOcPbLvw2gAf+PN3vD527BWG:qQyiKa/X+PN/VQBWG
TLSH
T124667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c5e1f138dfee4e3a38e1348ba568f23f84da40b113eb643e07424e0b1fd1a26f
MD5 38294039299b10a72ba283e832e453a0
SHA1 d6afdca63368a7fff88796ff180d22312d690245
SHA512 ab93e513c590b7c2acbdeba6df474bc94d137abe3b9cc55e9e1250b2537b48bf31520799463d16f7f959e533adf98c1dbfeabdf2b6cbafc29ec22601b008a64d
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0IsqjnhMgeiCl7Ge:u68Qg55nhceWu7PNU3/xDmg27RnWGj
TLSH
T17EB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 acbf1ee90e6f55623214052e94b157f48b628b5e3462b31c4ecf13afc8cc3083
MD5 1330684c4a8f4d4e7afecad9b701c78d
SHA1 7b93bf5a96a463641f2ddd5365ba4af9c8808359
SHA512 c1b84dd485ddbdf2d9c69a502acb3e45a683bd5cd259d29f101f803b3de91ca8362c3463d717313969ca2e7120feaa9badc5fd7753fb63ddb766be2e89923317
SSDEEP 98304:Yy5112gYy5azzVvt69nLKnhZwD527BWG:xLIHEWhmVQBWG
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c6355e71f14521e4829b44db68c3b7ba3c865d5a4e21a83c8abbb4a78ef56c0
MD5 47fd3d39284f0a07b35cf823709fc084
SHA1 7e8caeb9164c2ff4228f8bf0c4d41b5d6beb3c44
SHA512 956c77996872926c9c9f3e7742ee9f319584b78b4d3e06548907365a9c90aa6068d038e50d2ae7a598b28e2574e5a01687b23523df33701e3997a972c901214b
SSDEEP 49152:5B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl3Dmg27RnWGj:vu6Jmdxd2d3D527BWG
TLSH
T1C4D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c4a9b25c0c4fde6f6674d7c37871a5aebdd375122ede7c23bae60c7b128f4ea2
MD5 8e6f82c4bac7b2e83e277286a2e4caf3
SHA1 75f7e16e4c5a7395de3f8c52fc2966209c335cbe
SHA512 8da87b190ccc46850e3602913ffac2fb92d4c8c471f01581694d2f22eea2109a7655bb593f6d14b99b6c92eab7459fd63d40df689c806eb1cb50dd68bba0ac83
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xDDmg27RnWGj:lmifPWRuD527BWG
TLSH
T1E6B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 daaf50bf3417a374c4812cd450256f1267e3f443cb50a60f0aa691e1e52f4dcd
MD5 1e3d371bbc6ab3e5f6564471a90d5371
SHA1 c00f3cc47d349758b18e8c92e0c7bbd917e53264
SHA512 fbe9a653969c3a17bf401a7f88292a6a7df65a537f1fcd3db7ce161e3e513c244aee9c6ca30abadfe971cdd2d0efd84a97ea85f76ad51b5b6cc9eebe10965ecf
SSDEEP 49152:gSuZQIY0Be2KcRVtOnks6NMHqkDmg27RnWGj:65dKii61kD527BWG
TLSH
T1A0C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a461118da5ec5b917addc1cf788ab293ff4fdf46f56e3de64a4f4f76c8536a4
MD5 f32743ede26ff49d5c52d6965a16486a
SHA1 2cd3d044b4f6ee5f6b882708a11f1f49dfab83a1
SHA512 409d614bf83791d8f17f0ef52a659e021a5d6b7de64df43c7430693ef7f9f138cd9abe6f9c94bc692871fb68f5f471e729c2a565f50f8ec88cb604203576bcb0
SSDEEP 49152:ChtSn8EApI0fig3giDn0AP5wnDmg27RnWGj:jX2imph6D527BWG
TLSH
T1F695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 90dbbd98741d4dff7d5c59305407e3d3ef3683f096fae6db5787ed04cfc55094
MD5 1c3db8c0168df16c83b83481b42cba49
SHA1 15d86bba3069f20a59e90631bd40f793dd2d1f08
SHA512 85f8137777ffe8ab1ba762f5cb2bdb55369ce3f1bdcd1df93aa4ceba24227537f4105e456450d4c4a90f486a456189766c41d62548f1f7667d8aef59c1a1dcae
SSDEEP 12288:MsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MssqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 088114c108f080bb71baf3bc23b04dcd25130c68813dbee705e74a1cb39c0a21
MD5 a68e56d2e60b8c4ec88217448fb59726
SHA1 a71e3002cbe704bfaf5a37718f3df320d80810d2
SHA512 05ec23fb9638fd3850b290ddfa85b7a9cef50ce30193ef9aba6b7c31b95e13e05e303191cde990e75e8faa090b77da2d7be4a1371a0bba82ebca243005549ea7
SSDEEP 12288:DBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A9B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 acbc4a46170c329121de7b1399ee92e67b1b6de0057f9e5ab412966a5a6ed08c
MD5 3359643697db7bccba80873793770c91
SHA1 f43564e880c27d7ca52ef430b054164baf3d3adf
SHA512 704e791e08e088a9e2e73581619b42cc3061cdf6c70962462806bb471557a5bcb902408709307e1f02540d4c79d8dc78d68df2127eb78e96e8bf6df90780de9a
SSDEEP 12288:RXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1804523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 7327285a125d8d90bdccd42c6393e44db38fe6caec2945ac14076d9fdd411b2f
MD5 b30b45fa8e59006516d289203da9b8f6
SHA1 056046575f7a5d13819e89017a0cf13c31c7fdfd
SHA512 a786157624d44ac5fc9b74446fbf004c51621f97c186deb4468241546f34267839ee0e3f2e706570c3336bbdfa8dea3e725307c9612f27e0e6ba53cb7e25c773
SSDEEP 12288:/VaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13045236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f8aa89597e897c745ff45b2768e0e93ac7d0819e9875ca3227c54b7cb5d246d3
MD5 6581064524eea13313b9c687485fdbd6
SHA1 1c9a0498ea1e7080649052bccb9ada4ef81e90cb
SHA512 9b5cede0aa2b2a40b34ba4ffd11a63b54db511174613b3574352dc476cb7b1709e129621fbfa76674f213cce1aec0d44ab6e6d660a300a39e5fa3e5a12984091
SSDEEP 12288:tCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BE965C41CBE52648B5C3E5F14EAC073E5BE92004837A9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3ef81c5d21806b44506a90a404f59d1fb30e21ca8ac2503734d7e47c56ffd7ce
MD5 c262c508912b90e8a656ed431755789e
SHA1 0fd43a73fe85443f3593371246e7068f94cffd62
SHA512 ca59a1aafba18bb2a389c02d2d8c70b23e9ced059c8b2ad3d408065a31025443f30ff14b3fb7bf3ce3c87b0262c3a4234a9204201f6caf4b307b307ea1031ac9
SSDEEP 12288:TVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F64523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 daf508441f8a8dbfea25ca40e85a244852e245518a19d6f4f826a92b42369ec4
MD5 f86f68e629816f76c4aa1339c3bedd8a
SHA1 1db8f4d61583bcd1a97bfc85745fac2cdbea191e
SHA512 f4a53db150b8f35ed4fc7b023e19c984e9e06d2295a7b88b600b9c67743ca36b807eaac05b925f8bea17a6c433c4f2cdaa9ecb8b68ea99a2cc921bd25547997d
SSDEEP 12288:ipXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ipsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BC4523BE965C41CBE52644B5C3E5F11DAC073E5BE92004837AA7BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b1befc3c2447e547609c5be1fd903f5e50815d40a3e137aad9aa8c17b22fd736
MD5 f190c048983e95ceb9dec7211ae7b5a9
SHA1 3269ab674e00b54b1ab8e9ca3feb2f5718121694
SHA512 b1a80bcc3247944730a46b29456d87270e8fa83ab45a4783afedda1fc1e1511b7c26537a023719d7c92d577dfd079064c50e15864834cc370519afb2a8da3d6a
SSDEEP 24576:cZMRzFVSOhsqjnhMgeiCl7G0nehbGZpbD:cZMRzf5Dmg27RnWGj
TLSH
T1E96501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d961b7bfb94a38e1f0d5bf0d3109a027dae637e36cdf035739e5eba888d10bdf
MD5 db69ffaeb1a6086f3e6fb1d44e81c17f
SHA1 7584b3e299129cc93c5cc407efc6225b8e8828f9
SHA512 6ec0f2788f0a1a9c50d4e0ad0a3208f3d23c161e8a036893c9f3134a0ad38cdb6cca81d01d0df34ed541b8e9ba91d74909a9d1a7773b3b439856b7d80bd44689
SSDEEP 12288:1oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BF965C41CAE52608B5C3E5F14DAC173E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 7ba09a34a439d201e0fcdc271a894e2129cffe2e3198ca8c83e30a60730b0618
MD5 e22d7b27234d958ed0bd9301a2153bcc
SHA1 1a91b0caa392f520a03142613b32c02b5b3a03a8
SHA512 f78d95059d4d0a76c7d2405796afc77cbab0c0ce74444370df5491ffe2492720d9ae30b57509979c19ed6eb82914692c6cddc919a4b7720700de1f70dab48983
SSDEEP 12288:7EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7EsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A4523BFA65C41CAE52604B5C3E5F15DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2c3e69cf042da063199e6cbfd02f81f7e0389d772c0814ca735d98f813416293
MD5 5c1c2e9b537ca7d6e16fb60b8b3bb4df
SHA1 9d9565b2154163ccc08993c9114a138086b02c6b
SHA512 d46ff642339967877d0680ac99e9edbc5588b2bd8b0f4e2abc87a312bdd8fc3b3cafab3a6e6cf11d797064a3d322bf509ad0021e47a17d95e9170c96cfec90a6
SSDEEP 12288:uyPz5L8tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zzytsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14155125B73A530F9D1378138C5A29A06F7337C3247204A9F17A106BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 04152918e7258193c6049f810cb6f3ffa8c423d8b6cd9213ef856e031f85f914
MD5 c24abf5c9f5b7024ee964e568325c0cd
SHA1 402f88d6a86f983a44799b472de3493a102398e5
SHA512 6a8080b254317667e36e19518e34178585d08c7c382513be160e37757028ce366d20164749b329a25193940d40ea1934926371e6d66221eafef1a89e16e34c61
SSDEEP 12288:EoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 05be51367a7cd034b573d0e1e73139e4501a903ebcbb559c13a8f2484ecf81f8
MD5 7c804ec304a6fe7d8941abfa0e340988
SHA1 494d9e50751f7a607a03693deebe8f4dc9020f05
SHA512 206859fdfec653effce7781551e4ab05f61963d9e9f311def61035e4e75702090eae12c45714a3a1007b9ccf57954ef203e28f4a7fc3baca5af4cb134d934ac8
SSDEEP 12288:doXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f55710b7e25c7f9f3a720394c13e53240bc99cea7fb6170f54d5c8c5935d6cab
MD5 019759af2501eff6c09b3403b1e78758
SHA1 d2f321febb3c663348cc18d31c08130e512031c5
SHA512 424f3996469590117557965aaddef8d07f1c7bcccefda5dea5c6f9ed96f36f265998cf955a77630b8fa2aa961f8778f78e54f5c0ee0cf3bc76c0d137b722db40
SSDEEP 24576:oCU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvALsqjnhMgeiCl7G0nehbGZpbD:oCUZPTY+8Wg2lIL8lrIUJLWwGDmg27RN
TLSH
T1B965AE1EA3DC0896D4BB81358A51CA06EB32782E1B3196CF2160C77D6F67ED54E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7d21c14f685a42691656ccb77d1ccd0601dd23663f215daa5f0905d55e82e5d1
MD5 2d33b6e84d55e73ac19539675a037f6e
SHA1 7f3346de99ab0e801ede3006fb906a12d1816235
SHA512 6503fa36d8dc52316d779390a5cfb555ea659f205b25529adb956fe19642570ed984f86e8530148d323de8fb234c3892a9430c0437bfbd72908906543bd33d33
SSDEEP 12288:Zbsf4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:04sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF55015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 4f16bd2c227b5551af0acd69ac7a7ac1cc9be2567a146b736ffc169f215f600c
MD5 1dd49b846be4f68f69814f9537874944
SHA1 ad7d8a4a0c3b6d2e5ed6e259d464476b9e87f796
SHA512 e08eb88ea6dc061ba7270c0ea552db4b022a8b5198fc801578dbb049b2814a98dea545e71bb74be16852e01730586f407d3f99b21efdeab8fd1be3efe8e8a713
SSDEEP 12288:m3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:m3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DB45237AD34C518AE47A49B482EAF12D681B7E669F2004C3B94378FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1ce467898a2f3b0d334577cdd37ca952dc0385b2139348825c57a72b5e197957
MD5 ca52f271b269b826b23e6cf0f1ca63ce
SHA1 ad5e37d5a04acdfb9eef051f6fe1fc894ba38c0a
SHA512 16d4c9c36e7b2c2e2154ae140a281f7d31a94c5165ccc6480666e6a6dcc8420a4c260d0c425bdd8012ad7445e286bf92142b3ea8b9812ad7e119c0e291e65dd5
SSDEEP 24576:d8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCdsqjnhMgeiCl7G0nehbGZpbD:iRZwQCyiHiQEaiPnM8Dmg27RnWGj
TLSH
T11F85B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e30e21862a6138f0256711262acb47b018e4d4b090c2a54053c04a3cdbdb14c3
MD5 1a29f2f3e9fd65571da837b96f6cd788
SHA1 9cb5d661662c34b4c7e88cbb81c7e2b5c8d29cc0
SHA512 c7e717b0035d8d3c5193ee672b1db4c34adf6751ad60e91c9f1cb8388007b75987e5eeca0a79d00238661b93713e18e58c50b1a17fd2020180fad120720c783d
SSDEEP 12288:sbxA1U7KnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sbxA1UGnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C855123E62AC20E5E176917D86D2C10AD7327C26672053DF25D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 35db89a8596254b385f2e9163d312238cdb70c08b785ef89e9cc29a732375599
MD5 7e4a8ffd89a060cd0b39c5d17efdff96
SHA1 13cca2e613e7a5049a1785941286a379c5442aab
SHA512 496e7294958ec0d5ca9e62e57eeb8a77bec991b16bcc68aa55e1bb446934656c02d7174ed8935c954d3f410e2e3cbe0266c1da405921c86403892f1aff7b9f33
SSDEEP 24576:OjsmP0yHaqrVqHra44KDzMsrnKsqjnhMgeiCl7G0nehbGZpbD:OjRP0yHfVqzlAsrneDmg27RnWGj
TLSH
T10C45AE2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 dca0a502b262dbb8b911ed0217481715ee1951271b7c72fa2e66efd928a406ff
MD5 5b78dee5164da10d7ada9ee7f6fa56f6
SHA1 2e337ae653154d51d7963be8f60d6ce10876678f
SHA512 8e3fd0e24f753cbfe8c73dfbaac39c04085b2c777fde76e651e8cf975acff91ce8c30308f0284e419ba4d9bfc04e11169ce225e02b55edfe43c8480a5e3ea8a3
SSDEEP 12288:V1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1904523BE924C51CAE93649B5C3E5E11DA8073E66AB2004C379977CFEE7B54E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 8a64e9cfacf77d5510d90712032399452014e44697209ba6d79432c26d69f633
MD5 873ba045eac16fd60fa5222184c4ddad
SHA1 bdff2b8d633a73145674cbb7fbb8dee71cd36b63
SHA512 4d9de3b98144961a69bf4adf795f8831f5827d30f25c9d3e474d3bd336fbe4ff54deb77c7728d158a0aad1ee2cfe0994236fde5e9f6491e0f4cfe6dbf00b97c9
SSDEEP 12288:iObfA4LWO+vAYFTjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:TbLBUTjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 fad9cb5bf15cc0c4f7124b425cabbff533900e58da496dd3c7d5497968f11148
MD5 0fd25cb6056b9aa1c39f8f24702e5dc6
SHA1 14be7a4a9d0bd960d3193871edb06edb2f077ecf
SHA512 43c61d46e60a980cbfb6edd9ea8a625e73aa2e306d6a2c580d14d2c5dbee9bc24e96a8c65fc46f887f7c7ea62beeac5b908f2e888544c7a82a38d035ba69a971
SSDEEP 12288:A70Vm9IYNvUyBp8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:dpYNHmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11265E12FA2AC08E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2032fcf90fdc2c8af4c934cf48f1c1702003663b309693eab05ffd481dc432c7
MD5 0f7611b13b118e251cbccd5926625f8d
SHA1 134472ea84af064ca56fe255e0aed220f02192bf
SHA512 45514a2ec58f7cfed48650dbee6bc4f89c2ae9c39bd909d684b13fb46e0ff454d4f64bc05483401e465821709ff72022b0571c5efbb63e10b1698f642ea34a0e
SSDEEP 24576:cnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKW:cnXoJJYH84VVS6AmEOJas+cHBjSSKHPI
TLSH
T12965BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f57d616ac502334157cb921f42ddf35cf5fb558a9cff7b34d54640e3b27411d6
MD5 d60100e6cd1dac9fbd6f3889fd05f5fc
SHA1 ee6f7855ce68fbb7548437f7dee4bf31d71d0ca9
SHA512 b4f19c557427b210fb4222e562b3c397be420f57f687b2e5a4773b8fa9505d515b8afa54ef435c1da1f75656ce1c3969dc358d28a5f44aad9114c160e5a63cb6
SSDEEP 24576:iv7Xbxd9Tuycf8M/TYlSuxrr2PC0sqjnhMgeiCl7G0nehbGZpbD:iDLL9TuJ0M/TYj2PJDmg27RnWGj
TLSH
T1E3858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1291856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7468c6f59bec12504043f131f09399b87b117f9c159fcf0b313eb9fc62413b7f
MD5 1f11a7e5aae9989a7c059e6fa1ff7cdd
SHA1 a26eee2a251efb36651f00d77f9dbb64e224170c
SHA512 c2dd07943132564ec158da45f9db1f69c2e9a3b70c29501799240ba806704042900456d3e31d00f465861a430cc48adeb7e04018d5a56795bbd46682c680a990
SSDEEP 24576:XegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wjsqjnhMgeiCl7G0nehbGZpbD:XngOJOmPOHznDmg27RnWGj
TLSH
T12A55CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ce6259d3e4f95fea4087b2a942432183fdc1054fa59cf55a869906e97cd5e2e0
MD5 1e0a566753139e298224579e3918e5b8
SHA1 dc10505d31db21dd9c01995c7127e6a5aeeeb1ed
SHA512 03f2b6dc29a663b6af00d5d89387707d7b004b48e868a712381d55d729009da335e4bc1b9bc678da50b7744324949e3ba0b54bee6c355c4e46483babb4385ca9
SSDEEP 24576:3LJnJiTk3R3waE4JrOVsqjnhMgeiCl7G0nehbGZpbD:3LJnJK8R304luDmg27RnWGj
TLSH
T13F75E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c537050dccd6535b8d4b9a2cdb0b5df1cb15eed42294f02dcab3acde72e06edd
MD5 8f7de85abba54014c25f024074e0f138
SHA1 84517b4cf79dc713e2ddfeb364d2976964c2c4d5
SHA512 18732595744f5bcf03721b77f5ff19dfcd06abfc06b621a95bde6d4087f8035c2aaf0b8f116b50fb783a501c775b8637086b2bc5aa8d4a5eb29343f03829513f
SSDEEP 49152:s9mqCzDScAZmlvTcFg8Ph6tDmg27RnWGj:OKD527BWG
TLSH
T198955C15F7EB5298E8B3C9F1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1fe1912fa797392086544551db737f23d5aee3699d52abcb664a3712ffcbb8b0
MD5 3cf1444d5d929f8f785865f895590a6a
SHA1 7f68cf0a214ebae057cbf23cd1551a1d136e57ee
SHA512 bbf87fe142a6757919787af77db83e05d429f0aa28e38fc418c64b8b2b8f4ac2827d78bc44a9d34b370c6515c2f156c57d1d0a88ca2693899620d9cfdd365ed1
SSDEEP 24576:DlYJeXm5jUuETsqjnhMgeiCl7G0nehbGZpbD:DlYJeXmRUuEXDmg27RnWGj
TLSH
T1525512AE669C30E5E13A8079C2E2C508E633B872671017EF55E1D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 84403965d88e77da59b4224d4f8b5e76a324bd2dfad8f51fd62483db43b24bf6
MD5 43b0313c07c7d6d5b8b12434c8f937e4
SHA1 580bbeabb6120d73d1fc62a303573dc7485a744e
SHA512 32625023551b76ccd92fd82c6784fe7a57f04ec01d1093a76e3e4a51240e5a05c60b43d5f1a4a0d6b2dec88419b5b5575595fa819c3abc79e7bb5bef449f483c
SSDEEP 12288:imu6kyqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i7tyqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T169552219639860D9EA760578C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 b20a846012299a29d9ce1d72a2b525a43253b99daa925b0d3db28234938a26a6
MD5 62f06c5d3adce449388a560a7c439046
SHA1 7fc62281e6bb35f13ed3e6d26a43b0c7a6d09a3e
SHA512 cf9fbd9dfe05f3ca0124fe7a3ff7bc2cbbe1d254902f02e173154d0fe77a741bbb704e5cecc78559f5246f5d654f79bcf29d5b932ad334e69cb2b14f0fe7fc27
SSDEEP 12288:8PjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1754523BE525C61CAD93604B4C2A5E10DA8173E36AB2014E779E3FCBDEBB54D44B38813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 adf89860987877784c6b3d3b6458b257cde5d1778e73af16227ca7c0e402f093
MD5 21e649c0efa0419e2b5ea70d52627a14
SHA1 091db56e759e5ae0059676ea021f45b610900d46
SHA512 6bb5ab380f2ed0134ffadce0e0144a6986a2457255efb125c7f8f9678d3757f8ccced0411c81c84ed1babacc77c3b4d1a0f6bb72df8b397c3476aeea6bb9eeae
SSDEEP 24576:5C+TyQIu93VAumZr7jmYsqjnhMgeiCl7G0nehbGZpbD:5/TfIq+YEDmg27RnWGj
TLSH
T1D8558D2DA7E91DCAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 79cc9310ef6762bb7259c60f460149099da43b2deccccefaaa5d980237be37cb
MD5 8bf55768e95d75b86b3eebc1602ba788
SHA1 241a5d013d51bf78e3430f1c446f7c8a1dd31db8
SHA512 9ccdc1ca4c1df2236596c8bebf828047102a0d2fcd595bf13bfbd7c511967e1dc7b4e827551d863836dc4317b80190ad0652f5f2c4b73c0702b1a540162ca3d5
SSDEEP 12288:gcyrWOstaa3kcsPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:1LQikZPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19965F11FB3AE00A5E0A7817CC8858116FA737835571163DF06A1CB7D5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b7bf0cbfc431d56af135f7e71c0d9f9363a92b7d5a2b566ec0459af075f85d11
MD5 b4e7ae8e1ea1b0c45fbc162e8d2356c0
SHA1 79a6b64725874bcdda00087bbb8246e834b031ac
SHA512 1d463ed7ad97f60a0f8571942f0bb67b7ea141813a48131daa8319c5d67dc4b2f55fb28d6833c5b9a3d291789e20cb96b665464dc945e53009e0071721f282d6
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP+Dmg27RnWm:xpC7b4+80GTkFD527BWG
TLSH
T118A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b050c6acf509a28863d545ec7aa5ab08846e4b67e070ccfd1c29cf3cd6b03ad3
MD5 9fce3396700199e5455b0db1bd29170f
SHA1 48bb9ff08987d73fe9a752ef3d0fc2074fc66b26
SHA512 847f0909b1afcfbf14d192b6160d59855b536ac2de674224b5291ed8043c95d7db48df32cc32e1e201a5d883525646a5b2a9b483a942e00092e11382d53c00cb
SSDEEP 24576:zSAwJPE1IDAo+4Kt+l4413JUQisqjnhMgeiCl7G0nehbGZpbD:zqPCIo4Kol4vQmDmg27RnWGj
TLSH
T1FF55BF2AA7F946E5E17ACBB4C663C601FB737822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 fcd1a9d22fdab4bc0da8cfaec359ea916bc9ff34f7a6bacf4b9f5b409e590747
MD5 14c7f93cc8e03246bbe0da5c18aef7d7
SHA1 31388eecc4534205248a2723ecdccdb59f79fc07
SHA512 a382d4a76dc4a3e8f6fe4448ced42f2383e1e25b78b5d3bac6282e30678e7f308182dd1b7e9fb2d8b5be2949b3979fc9a886efb6a641e179da404893967a2e43
SSDEEP 24576:RyLXPLcw94tSsqjnhMgeiCl7G0nehbGZpbD:Ry7PoXtWDmg27RnWGj
TLSH
T11275D03ED76C04E5E47AC27CC6A3C506F6723CAD033166CB19A095792F6BEE46939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 dfb8429b39a5430470901819148d458cf9051d9c38e021cff0c9ea23f77ba44b
MD5 aa742af0c8bd7db41365e409806b3255
SHA1 cf8078621ed6f526b6095264a0c46a351c8cdad1
SHA512 25c984e2bb46f92f03dcd926e418dc1b701766d603b424be3ede5231ac03e6ce4f39252023cf5319c83fba01b85ea7c2f6b12fb7a80c5a04d0665d23a98a56dd
SSDEEP 12288:F9lyvj3IkxjbBzfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:FWv8qjpfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C65126E529820D9E43A4674C2A6D12994337C77173459EF75C5E8BF8B31AC0CA3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-136-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/240-138-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/240-262-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/240-130-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/412-123-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/412-99-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/412-105-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/816-185-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/816-61-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/816-67-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/816-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/920-468-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/920-240-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/920-250-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/920-246-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1368-159-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1368-317-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1368-162-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1432-395-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1432-186-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1432-183-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1432-177-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1484-122-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1484-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1484-12-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1484-18-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1860-258-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1860-263-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1860-504-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1936-238-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1936-234-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1936-467-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1936-228-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2020-471-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2020-275-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2020-470-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2020-150-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/2020-141-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/2020-147-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/3280-237-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3280-124-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/3280-117-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3280-109-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3292-472-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-474-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-482-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-483-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-484-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-485-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-486-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-473-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-476-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-478-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-479-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-475-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-480-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-477-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3292-481-0x00000255AA5C0000-0x00000255AA5D0000-memory.dmp

Download

memory/3404-38-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/3404-49-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3404-43-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/3404-36-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3404-46-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/3844-195-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3844-189-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3844-197-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3844-435-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3976-249-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3976-128-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4144-279-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4144-271-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4144-265-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4144-313-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4144-277-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4144-540-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4144-295-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4272-172-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4272-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4272-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4272-50-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4276-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4276-33-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4276-31-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4276-466-0x0000000000BF0000-0x0000000000C93000-memory.dmp

Download

memory/4276-126-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4388-94-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4388-210-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4388-87-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4388-88-0x0000000000590000-0x00000000005F0000-memory.dmp

Download

memory/4700-226-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4700-223-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4700-464-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4744-80-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4744-85-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4744-83-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4744-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4744-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4952-170-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4952-164-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4952-343-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4952-173-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4960-215-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4960-213-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4960-212-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4960-207-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/4968-0-0x0000000002F40000-0x0000000002FA7000-memory.dmp

Download

memory/4968-465-0x00000000039F0000-0x0000000003ACA000-memory.dmp

Download

memory/4968-120-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/4968-11-0x0000000003830000-0x0000000003831000-memory.dmp

Download

memory/4968-9-0x0000000000400000-0x0000000001142000-memory.dmp

Download

memory/4968-5-0x0000000002F40000-0x0000000002FA7000-memory.dmp

Download