62f291460f4529dfaf903f123df99948f7cf6c9f1f1023cf6743e68a32f9c778

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260509-syn3fsds5l
SHA256 62f291460f4529dfaf903f123df99948f7cf6c9f1f1023cf6743e68a32f9c778
MD5 4fb58213958e607e0e0a3e8e75edfa2c
SHA1 f74a713d065d464567987ff810f4ced88b27227b
SHA512 3e19fef1132b29b0480d079c27e599f5d1dbdecb4cbfa66c699f3687fa9926345a4aa5707de4e723dc1c09eea6017eec40fa0e823b50856f0045a8e03a379092
SSDEEP 12288:d1igRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:eknQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11D5523297950F477D91709F51892C6819B3F0D817FE5A38F7B88227E8B393D00AAA385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
5496	alg.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
1764	fxssvc.exe
1176	elevation_service.exe
1956	elevation_service.exe
5232	maintenanceservice.exe
4192	msdtc.exe
1500	PerceptionSimulationService.exe
3304	perfhost.exe
5592	locator.exe
2132	SensorDataService.exe
2188	snmptrap.exe
5028	spectrum.exe
4792	ssh-agent.exe
4916	TieringEngineService.exe
4444	AgentService.exe
4124	vds.exe
4500	vssvc.exe
3012	wbengine.exe
4216	WmiApSrv.exe
5044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\dc85588958e99e9.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83296\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029c03d3dc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000204eea3cc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025fb383dc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000311bdb3dc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f474f13cc9dfdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f095743dc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
4524	DiagnosticsHub.StandardCollector.Service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4744	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	1764	fxssvc.exe
Token: SeDebugPrivilege	4524	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1176	elevation_service.exe
Token: SeRestorePrivilege	4916	TieringEngineService.exe
Token: SeManageVolumePrivilege	4916	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4444	AgentService.exe
Token: SeBackupPrivilege	4500	vssvc.exe
Token: SeRestorePrivilege	4500	vssvc.exe
Token: SeAuditPrivilege	4500	vssvc.exe
Token: SeBackupPrivilege	3012	wbengine.exe
Token: SeRestorePrivilege	3012	wbengine.exe
Token: SeSecurityPrivilege	3012	wbengine.exe
Token: 33	5044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeDebugPrivilege	1176	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 5280	5044	SearchIndexer.exe	118
PID 5044 wrote to memory of 5960	5044	SearchIndexer.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5496

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4616

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1956

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5232

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4192

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3304

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2188

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5028

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2588

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5280
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ec77fcf10f6fa09cf4578fdfc1028fda217096b62902cbde37dc91e66379b483
MD5 8f30a197315cb6e1b533e01df37b86b6
SHA1 b98aacb17e228f2b29388860549e61f1291aacaf
SHA512 56b7371c38d861a309de6782a3a5cc47df98173eeb23c208fbb63d8c9f6a7c8749c3ca70e2c238f6b8420903abf9d3ddd9bc9808b366a73596a856177def00b7
SSDEEP 49152:Vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnoQ/lFTjN4:r3q6HjBoLm
TLSH
T131D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a1b5664a855ca67e12953d64591acb6fefe24a5f0f47d748a21628552faf773d
MD5 15c85c2c4a8969cbcf8a0569c7cccc04
SHA1 d07cba6e6c16fb673c30abbdaca65dc434e0325b
SHA512 5d0544c59d8278f3f6913c9027098e448b2e600d6dde03cc67b78f69a110c255fcd21bbda2f5da9fbedb6a564f4609f911e9c081e902d38a299bed73b6fa8c28
SSDEEP 12288:X1XLsswWkxy2lRq2czA/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:FXYfDtczAfnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1D765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a6dbf887687741e93f4cd8eef1b6a0a97b2ae44259b0f5bbc1ac6699284fa24a
MD5 e2b690bf4d1951e6c2a3536a8c44ab4f
SHA1 1ef549f8e8a12fd79fb534ea65a2a3e4ea27ef81
SHA512 bd565e506276fa17e6baf876b8f0e4a9edb72a1968554010f168b64d44a7d8b465ca3204c969f949fedab12ee06ad3dd34ada1527b4e8ac0f8b53dfbeed6e061
SSDEEP 24576:g0Le5ji0hmxLrMVnQ/tbw/2Mkjy6Fr7g0o6:gPji0AlcQ/lFTjN4
TLSH
T114859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 899d6842c29b9b71d900421a265c00c7f845da337dc8a47baacf5271e70ec755
MD5 b5bbdc12c4d87c3a6b8c93c465d89a3f
SHA1 634d5e2483136369bfb4242ad4a2a393c5295ddf
SHA512 1086ce0a10cdae7b975b1c84e3ea941c78fda7404fa6de39d8f09caace5db882aa7150381878dba798419d38d4080027d1f49a36a0b8a7e23829cb3c697b8b89
SSDEEP 24576:ea7/ezSC6vUyD/aqgrvWE6q8wyubnQ/tbw/2Mkjy6Fr7g0oR:Z/ezSC6vUzPvxHjyQQ/lFTjN4
TLSH
T13D755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 294186d44bac18d7eded83ea188d4f24ee8171cc1e8e6a3f79071ceef8be01b6
MD5 d24db7ec45aa3e890fab554275f5926d
SHA1 a7f2340da0e36b905f2b7d763318c029f840e83f
SHA512 3adc04973ddaed4785dc66b248e293cbfdcbb23ad160317cd833282913b758d21f70489a4bb0424621b023a2b013d60ba0a089c6095e2f70db33857899f2256a
SSDEEP 24576:wVbqPb88hv/l+6GnQ/tbw/2Mkjy6Fr7g0oq:wVO88hXl+ZQ/lFTjN4
TLSH
T1F7559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 11aeb18e6caef771e96ca01b8490eca37d30fddaf15d798408aa02e9e51ab988
MD5 145bdd90563a3752e0ae521e98d10b86
SHA1 5a9edd34f3bfe51d97f62448f132348cdcb75076
SHA512 58814ea09cb8a165d6c3895b009bd7c2d55c13d9c82294b0dc6e9949420e48b828594f30a0df9f5f8dfa7d92a06b736197b192e03904e2b48c9396b8a3d69bdc
SSDEEP 12288:OzxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:OzBnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1595523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 947aa43f8573bf37fbd4a3480a35ca630d8aea9e19c7ab80add083581ddd3ed3
MD5 2a8873633663cc11841c57823bb9c092
SHA1 63a4e2035cc78d643e006c5390d991c3b48e276f
SHA512 3e4bddc3f1c7674099093624021052febf2247588b516475bb4c26665cd9a5d6b233bb8b9ed41bf00f7cd2279937140cdacc5cf6d5a0dde849bddd21025b5db9
SSDEEP 12288:7eBNUbTVO86U+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:7JIU+nQ/tbw/2Mkjy6Fr7g0or
TLSH
T15C75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5eee8a1df673de7c1efee4c99dd13dd6eb6eb62114cdc3e367a621f9f43ecc3e
MD5 724b5c8a3d52d612b0db1bf9fc3b4dc1
SHA1 5cb9b3d2bc78d59798a5b04ef103ac428b1e5fe5
SHA512 7e1243aba8b3586b2b617973db2fe8ec90c0f8e97da99835a6c73d2755ca4322811949b0212e410d0b0efd76785d6a7fc0987585faa67346e09a1d1a5d2e6251
SSDEEP 49152:dQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THk:dQvGAdlCEL8c/yRNw5CgLm
TLSH
T1CE267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 146536fff0c89fa9cec7c326663c640e5c1b7c38f6703b7e4bc738cbf4180095
MD5 6db585756010e96581ad16bb83d5a633
SHA1 208c7c1b0ef0b6a3b703e0dd904f779ef410a67f
SHA512 5bc4d24a08858fb57859c4a787e540938facc6155fa55d94056eaa7fcab15be72ed18678c0c6d3659c3d7a496789765a961a30df272acba45b582dcec46af8fc
SSDEEP 12288:8AwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsga:hQewsAjsnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1AA75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 25c4a4e04a32033a5ba88db6c84d7ab50826fcde033b31420d7c3d48ff80f141
MD5 d77c214ea83307357036b9da36c7c00a
SHA1 8f8a3f4ee54f064f7f3936b1498ae52b6a25d4c6
SHA512 0e0deac6ecc0ec85065ec5b7d43365df71246e396bc34ff54b4429cf8fd0d187803c66abd236218bd70e238a94ba5ecfd0ea46fb979243b887c7950d20fd37c3
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHL:8UEtQevvqc2W1cpV2EI32
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a3d36a4c4ba8ce4ecaa49687585f015be9c287bc690c1cb65fb77aeff706d144
MD5 6e3f95fe4b029893dd332de2a9e2e394
SHA1 12c2c5728ab0029069fc8a45818d475e49a36f34
SHA512 594562b1d9a34dde0293648983f2bf925d3ce865cbc56c87c0b6f7e4e1b3489760325dff3a3fd4f6067da408c724675d78a3fe3404a6d96ac23b262accb028f2
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:toqtVjnm0Lm
TLSH
T1CAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6e4c372b8af99dff389798ebaf7adb51a732f0f469b5fd337c1045314933e354
MD5 4e31000fb9f91a9b70228005daebf763
SHA1 a2b738211107c6aa0a3605ba0df5317e2d7ba732
SHA512 126fb4ca2681e10226c6b8d13bdce77b811cec8c85f7152a7314dde5f1a645383f484f66d33f91fc10eaf1b3c4a629fe865e5c1bcf4160d01d3ceabc656d91fd
SSDEEP 24576:gAhGLJIFoiwtA5l7S53fnQ/tbw/2Mkjy6Fr7g0oM:gAMyFoiq5PQ/lFTjN4
TLSH
T18E35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dbf0d5560939f7d3a0eb956704898421e014a0de5b49a03b1b1c3a44f752f637
MD5 fce6caeab510e9c26c018a17d2f712cc
SHA1 cc633146ae9e5b3359bb1b581410a2d223c2167c
SHA512 2a142d228426034c9354e1bc825b9b617c2fe08dbf5608e2d63ab8ccb470b549c1bbce3a3d43b80d9f44e395b45e3e5f3b6e4585dcffcaf731f7685d114fbe9b
SSDEEP 12288:IXZ1Iy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:QZutnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T14655126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 186177949745995a1d8f603cd31e20ba2a81173b1b1444c5412a1894601c5d0e
MD5 aa6956dbed24418235fd703906d875ff
SHA1 ddeb1a3a208025c35c613f81cd20c25b2fc5dc64
SHA512 34d9ca6731040eeb625924dc6bdfeb5af45364cab7945ca87653e0b50450c34cf4ccdeb8453802d1a592017098542b62df882c8230c59ae36a8097280fc961f2
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:7QRQyi36YOcPQLvw2gAf+PN3dLm
TLSH
T121667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9596c35e9bac91b2944dd51f6602751ee8b0584992cf9df3b8a9668d9b6489b8
MD5 081354c5bc74de61f6fcfcbcca79478e
SHA1 aae2eb215c3a5d379c366a478862c0b6ca10cb2a
SHA512 7d67498ad6f79453ae107198fa4486ca726ded83d826530f2d8731f63db1b5fc7ea07a47460bcd4fb70e2f5bffa0cf53f786fddd0c0bfdcb5a4b864de2598a33
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uo:cQRQyi36YOcPQLvw2gAf+PN3dLm
TLSH
T15D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f51eb2e0d071497d2aa1bed958362038f95ee169d45129dcc26f1013d651f021
MD5 66646493710c8ca567f618a97a6140e0
SHA1 96f663b7ec66f5a63b27e47b1985a617e38283a7
SHA512 960266a61999e7537377c28fbdba38785d8a1ff8b3ff410d2fca28d274482cc74385f70f023b2fece6e6284a4cd44c7d45c11327e61da75abe70338c471458a1
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6/:D68Qg55nhheWu7PNU3/cQ/lFTjN4
TLSH
T1FDB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f13d91a6f8099b3a8d227b8fa571bb70627703e6f01cb554edc4241b3d34eb6f
MD5 a261f3749d8290e60cd85985d0d9d078
SHA1 30a33a36da3c5e80af1675fe14417662b38a3a63
SHA512 eec536052f1275bffe5da7e660f5bd19a684907d8350d9da9c1bd137f216dfbf3ce46bdc15e9868577617b024e917f248f97147bdd7521e0568776600ce0a44f
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:Ty5112gYy5azzVvL69nLKnhZmLm
TLSH
T14D167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 871eac3ea605e11f9c6677f0ede17234514b8d79cd42a52c0f61cd9b2d3c92c8
MD5 3c1aa4ac83bce3329140d3df3b78d175
SHA1 d62b60810e58e59e20d94ecedf022bbd7788139d
SHA512 a9517fbe9d91ba07968b91a874cb2b34d0c3855b32b4573e7edb586444e54f283a20d854a7821fef05150e399a8afbb57927ed03ec7a87731e38712475afbd78
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glvQ/lFTjN4:ru6JmVxd2dkLm
TLSH
T161D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 39a7936ab27cd5300f104dc74200127dec5fd83b7e0b143756489f5fff8eaa6a
MD5 e055433e95e0723a1823a5abfdf57a6b
SHA1 422a981e862615e66ce332ca90d1bccb9ce53568
SHA512 1d10df4a5259133a4de941d515ee29ee874f55bbe73ade0ab0ff522ae3eda372ecd8a1ad7348dc24cffd4afb005d678448fcc7bf9177b9906ebb5c97c921d5c7
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xeQ/lFTjN4:tmifPbR0Lm
TLSH
T147B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 170e9caae69fa3a79d32755a91de208cd78f11f9c14576efd26807f4fb5ed7b6
MD5 90ddc5ce6d2c18c13d343fec67a08898
SHA1 29ca759aad308775727f21499a93bb08c707ae53
SHA512 1bb903011d844637728af51de344ccd84649e1827c0de65fccfe1ac50164ee7ca1466eb846941f6d8a71c67b61cc2f945a898a7a4247aee67b1bd3bafcb3bf78
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:Y5dKTi61iLm
TLSH
T16AC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2775e2ca88261e0aeeca950c5d207b0ab8e32ae39b5330d0d8e7861b84fe52b8
MD5 c49855ac695a5c37f68f7f3f5e26c4d3
SHA1 751f0967f339d28e43c9e7820676aa468ac29817
SHA512 51d23230bce73880b180c5f11edb88cee3ac110649b9af2928c0262f8bd7de9df91bd548a2cd35b7f5b880fe5fecb9bb870df303fa24ee75de70b6174a3768be
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5w6Q/lFTjN4:HX2iyphYLm
TLSH
T1EA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 13ce6116264fd9213f4470da4ae7558f62bf7212567b898cfee8b277e7c530a9
MD5 15306cc76a39f6d50d9828fd099bbb55
SHA1 9a5ff13368615975f6a5cc85d0d63750ffd275a3
SHA512 0e972e8ba3ad4593f47d3e892af7d61599cbacac0f6d7852ef9834506a6049b52765e51bff0ae8de89d9dc6f2d8d5953cf43866f1a5552887c7578e55f296056
SSDEEP 12288:QJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:QZnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1B45523697964F98BFB1706F18C828182AB7F0DC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 715231dab8b0a8244b391f652a591813dc42257e3d678a139f1ade364d0ac25a
MD5 6a736e65bccbf74983c03c30ecf2f89c
SHA1 36492969248c353836bbd9148238725b1d130661
SHA512 93bd0da233c8f3eaa8c17f225c2562bbb514ac3c68a8064b597bd557d05d21a0fb786c3d88962f90daf161bf9f26550b034ef706eb63ea3b81506efb77f043ce
SSDEEP 12288:DYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:DYnQ/tbw/2Mkjy6Fr7g0od
TLSH
T18A5523797964F99BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c65f4f18c817080eeb9e4c9d0e1bf8266df1ab1175684936f58448593385ef51
MD5 3b86cd22fd375a3469eb75082393f73b
SHA1 731a181f4b556c9549c9b810be4fcc8e0bc30316
SHA512 595d5aba9295d78dce5b11679b05c1cff51f46dfd90de6d3141f989023af8bfac09ade6e53af332dafd42d4a05f1eeb0534a5ad103ba1f9e7db2786378c91903
SSDEEP 12288:iWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:i2nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1F45523697965F98BFB1706F1488381829B7B0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7804d1aba98ffc80d008233fb7cd6ec441150ee2dd33e058958a7978e842f8b1
MD5 21ebf549ce37c090f1068630dbe2b476
SHA1 a7a42509298bb0fbffd0e69c18063673f385ebec
SHA512 250dab6469e19072b5cd8b47235b69a1c4d24af252f6a359358275cb784ea82f6d144f2462563d65d8a698310e2616dcb1c7aada7b5c20cb507c78d30f34df00
SSDEEP 12288:zVfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:lnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1E15523693A69F4C7F92742B4CC928142E77B3DC6BBB1A3CF6B00111D4E793D419A5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 80494bba75e806a95322c0d21a63833fe67edff49a34323ef053961931288ab3
MD5 4f063b0485d05ddbcc5812a10ffa4c16
SHA1 d3d0b14e96799da9c79a2142044f748a6d4119cb
SHA512 47619da4bcc719c978d676bfcf25d7c3609b6cf3c459cba4019bf32fb5747d20a91df07309af286901d9572d15c55f342b9870b3909f31844a735c87e53024a7
SSDEEP 12288:+HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:+nnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1345523697965F98BFA1706F14C8381829B7B0EC7BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bf97d501de94f5c949d2b94f839d4b3606b3e840f7944a1970b9578557989b8e
MD5 3af0ab227e083ee7b6e7956c2ac48193
SHA1 cfc6deb632d0e3c29d05791b572f67ea3b614229
SHA512 fac6f4116c7913352a5df0975804f63fa5204117916ecdbc9be9597e817394b1556762fcf035dcd3391c2f3ef462933418af1c33eb1aadc4fcceb2573fe62ce7
SSDEEP 12288:5EGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:5knQ/tbw/2Mkjy6Fr7g0oM
TLSH
T14C5523697964F99BFB1706F14C8281829B3B0EC7BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 23030db1c8588085434ccea6ec803f51d2982ffb1b2f6f184aea3c95707f78eb
MD5 a9fa87509a77b3e1e639852b21c6fdd8
SHA1 d8f55c95d49fbc7f13d18ebf5a7d53e5368f4a14
SHA512 5fa97a363df1435c4774144924fbb8565d3c9e97473d0ada0ff22247fedd18ed6f742daba754f8127ea38a4b2b6523d3ec05310ac668033916d4d382e0f0a391
SSDEEP 12288:3AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:3gnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1A15523797964F98BFB2706F14C8281829B7B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 22c3bce7da211a12a28adc59a7ca804d1b1fed2553681ffdb79130783dc46191
MD5 044571d0394cfb239997b75a37dee191
SHA1 c1d5f786a1dbded779fd130885f02354684ffdd9
SHA512 0d908411745caa5fca2ca3280ecc869bbd2321ad799f5fd31bfcd90791dad7d93dcbeba7c7c2cd308b46688e0e65dc7ddcfb028733ea0b40f50fa57af92e3820
SSDEEP 12288:biZwbDzzFEoS2cPvy4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:GZM3zFVSO4nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T18D7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9863ee9890dc27777f128524b9bafe41c5505d14776b66d8f61fdeb62a6bd20f
MD5 180556ccc7ffbc253121c7dd26fafdd9
SHA1 2a20f0eb63f0d082b1a2856821775f1ea085ec88
SHA512 e062ac1834c54f1b306a60e1ccaef253935c75c7152969d32200d8ebfe8d2d0842e11196027dfd634180df60de81fbcf718436b645886887e27ee5e436a60c09
SSDEEP 12288:+dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:+9nQ/tbw/2Mkjy6Fr7g0of
TLSH
T1F75523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0e49baee15fbb8c527183bebca4bae90b27388eb43b21acf8f28c1b70b11d7f5
MD5 704e6db3bc33b14cb60b0f61552296c0
SHA1 c9331070096b04306d573c26ea8e0f2e875c82e0
SHA512 bc3da3b684d0b74e0ff6ca16ad171dd064de46f32c744ba1289c0ce4f4f36353eaf87bed479e0aae027e21df459a2ea83b413e9d8e8b7c9f457276387a32a00e
SSDEEP 12288:xBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:xRnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T16D5523697964F98BFB1706F1488281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ad5d6a5b8c6fb24da5a6c0e71d63eb45e15c811db46473f13ceafc1ed2374104
MD5 a89f42ea08e683c6b4dfb1410da67dd7
SHA1 096d0966042f2af651a54f9e969038a67132fbc6
SHA512 4427d37ba1dce7244fb0850c03697be4ab778721cbb630cd8eb2194501fc3641aff774207ac12008e7825e92d2ce09413f948ef971a6e6c4e21099ac3fe54ca1
SSDEEP 12288:8yPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:lzy8nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1B365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a5abb036fd82af07f4432189071ae8e8a55a9157cee382ab63d9d2e49098baf7
MD5 3baf17a0379e8726753d7b3e59a58355
SHA1 7850b16c246a76debb976f94e5a349af4035d372
SHA512 fd5244777e396c288629399ffb4c39ccd43300729663b5d6f0e72b30cf3ba4b2ab84473d3880954871df7bd7c8dcb092ae41191d830526cdf8bb951abdee9664
SSDEEP 12288:OdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:O9nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1A55523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5c0c4f0620b2721bba64331e3b9ea7afe447c2e624d2f2d1e2c748a7f03c3f05
MD5 f1ac08e26df2780752aa0edea831026d
SHA1 f258f228a876430b5ac355672e43245a6561508a
SHA512 87a51c9824fac3eac33f0be66017a519e249975a367138829e73dc40d29ccb16fb2ff5e0672a5f4d89bcc100aca8fff69fec4f7a2615900007ee8a7e73679f11
SSDEEP 12288:CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:C9nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T14C5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 950859b14c35dfd76565706da2b456d183b1b5f3d50741a166d5448682245a80
MD5 d5e026ac13b14b7c88fb231dcf72d799
SHA1 a8fa6b40c3ad7f998a23010f7a09e9eba718c71c
SHA512 dda49a21dd74ebcf069e7949c31045fb101ffff5a56eb3d41cc13af804830c470dd7122bca3cf71f1d6c42cf04e2878ae70cbb06b95d2a0aec870374f75d24f4
SSDEEP 12288:/yPz5L88GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:yzy8nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T11D65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 81bbfd6da679ec232f34d13c015e962b2117a347c6c0a98dfa2b158a53e60f5b
MD5 fd9abb5e097c151b76d27ac83064f897
SHA1 53e28fe7597f46b4bba4cc6013f83d0fe30f113b
SHA512 f01a945f5613b9ab66d23b28b74c35b2cab049fbb184c5ed3280ba361a5c39510d29e184969d9158b987b0e81648f083d3a505dc286a635440024ff30c5ef1bc
SSDEEP 24576:UT0aLl3z0zDmnQ/tbw/2Mkjy6Fr7g0oP:UTDLljbQ/lFTjN4
TLSH
T1C87501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9207c5ddc53d71bf938bccdab23083dd518f9900186b4782ecfcca49cb2058bc
MD5 3ec50463472f1bcb70927195f13f0333
SHA1 012fceca39970c867d1f3867af5b1708c2a1c884
SHA512 5362d33c08b075eae7873278b4a14511fa4ecf1bebda07c9249f446d933c6adcbcab95519601bd63d51bd6c4c768150782db5f5dac8cbb80490fbc2f71722fda
SSDEEP 24576:r31d9CHKy7GZynQ/tbw/2Mkjy6Fr7g0o1:L1d9CHKya0Q/lFTjN4
TLSH
T11885CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 308f73bcbe1fb2079a14c381c7ba89d9aa90659c849073c56e3af736837632c9
MD5 038671f7293c50a95f97af74080ed8ab
SHA1 8f6d7a411455b34701f1b1b80fa596f5a28167ce
SHA512 7d02c00297f89d7df05585a7ce42e728b9b1cd0ac0a15c29b15f750a4ad7332a7890ab0a65f749ebc6080f3971171d73044d6bb29ec5fd70b6b5b40aad35f58c
SSDEEP 12288:/2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:/WnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1725523697925F98BFB1706F1488381829B7B0DC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 66abf184d1a877b319dc45cd60f0227b78d225f808caea5828e2904a42c4bf99
MD5 312fedd464f87bcf8c3ea86de3dcfb88
SHA1 bf81188029a45cc580a5c714558f1b43836365af
SHA512 a76bed295d11bf4333a36c859638e473c8db5b666768c20850e21c167a5cf4ae997ef0f5d7dafd66e365b7c79c527c145764dc3acf9ae10847ac808c40a8bd08
SSDEEP 12288:HcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:HcnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1875523787964F99BFA1B06F1488381829B7F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 386516deadc8fa16e6c5f80c3cc3fd946396de7d63c79c2f2d7d896f080163e1
MD5 1159680e8f3f2a6df9cba235cb045485
SHA1 1b169d15c20b71a5c69b187997e49a43c060d7d3
SHA512 d5742dcce0b6c6b639bee40668570c884527f1792b8422e5d021ca53666a4dae9f72740301eb2e5e4de4b918c1d2f9785aedc9e163f8203e8ad1d61eb316ede2
SSDEEP 12288:assfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:ctnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T10765F119E29852E9D02E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 fe48e9c413e6b840a9107c9cab066a492004035ba9d4c116bd5adf96e349ca84
MD5 2d5bacb779dd913642b1e17809fec4a7
SHA1 5cfa35d9a27c07ca4ae630fe333f74dbe34759ee
SHA512 0f826d4a5d257c8c84732c76f2b8608781e1be905c0f2fc114b45a3119c236ff981a4595ebd067af55b27e7bf1f5db2fe2868262d02f56ae8ce16292dd4d5d7c
SSDEEP 12288:JqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:JqnQ/tbw/2Mkjy6Fr7g0os
TLSH
T119552329A768F94BFA3B06B05892C151673F0EC5BF91D38FBB08222C967C3D41DA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 6ecb5b811ae9cfbd2ff2522e26b78b99b117fb582e4dfc6c943de6356da3f085
MD5 eca13b1151b9eb87f6ad93d29ffea0ab
SHA1 2180f1ded73efa4bf4a5667a86bf26341dc3d3ff
SHA512 21f3decc0e0364579601a6eabdb522e034d96bfdeeae9a7b11db8239f1eed34ecc9b00c5ee3e5b124f787ea361d7fd0d920426e080d150eca3ebff6182700542
SSDEEP 49152:Ma0h2GEkuAe73q3pp46zwwQkQ/lFTjN4:Ma0hNYG4JwELm
TLSH
T1A2859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 be60c81fe78211789bd73421d6e29563896fe75d4b228e1253152a3c9d6684ab
MD5 a6d1383372f581215b7a8641e3f502e7
SHA1 9881f6316a2c2c529bae3be77644af187bbb2b39
SHA512 0dc2c485346b03265b5bb3e85c269e7d6676f62e707a11810b32dc6557eef032509f0ccadebca926ba0022d05d135a4899b3aed38699f6033103f3a33d0144d5
SSDEEP 12288:ShbHjfXdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:ShbHjP9nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1C955027E26AC30DAF63692BD88928546D7327C552B11A3DF2384423D4F3BBE41D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 30b5176c0ce8edfcd480f6761823fe8508ea4748f6f93e02c53d275ba1dc8f3b
MD5 d6fd1b5e785cd12b645f1f875709f63c
SHA1 ce43e5b7bc6e2edc26d35fe9a4195d6681f72b07
SHA512 168719d329d7a775f4a196ccfad873b26bd52f095f9232e123c5682891be5d155617fae6cea8acab1658b6292ff1d58ec746ff02d84008772b5725f67f5c6c48
SSDEEP 24576:t3YgnJcRTk4yti+R5dBR/FnQ/tbw/2Mkjy6Fr7g0oL:tIgnaTk46pBR/FQ/lFTjN4
TLSH
T15145BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a63649e901e56819da7eeaca91f7ea264b5b7e8de5855f272fc55476c21be946
MD5 82e4a6014d5e9956dfb0e5d3ee1b1776
SHA1 b7ea27332d1a0e7768486ab73f0f458d3b6f5703
SHA512 090d618c990db939859252fdaf1ab66152530ac1c85c80be070838f45e624f5686adf833bd78da96ae565778fc5592c74eda7e32d79e852b0d73d8e4d6f4b2ef
SSDEEP 12288:C2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:CWnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1B65523687614F98BFA2B06F54C838546673B0EC17F91A3CF77482229967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 eab6e45deeb28d296a0e112624b724e541c8b093394957aa4a258d2a53f2e765
MD5 9974eec95cdb670a43a6781f450935b3
SHA1 c2285085accf55c10909f32a0492313bb1d93875
SHA512 6f6c44b294c71fd7c3331207c9dc70ad4d0060a49153167e47e7c385d7ac19068a99b88d812e02e4d72bcf1ebd6c524baa45360aed51bf8f8de7e29a120ebad9
SSDEEP 12288:sOb4A4LWOsvAYFTlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:RwL3UTFnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T16E75F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 2c50633df01079977c6ba50fc486bcd6d01cdf476fe0973d51b88227769e0491
MD5 b26ae44af93b22f2113d25b8932a68cd
SHA1 8a530b7bac2a04afd63208dd9e65180d83715b19
SHA512 755ec99dc232f4db6b635bc80bd103c1d7fe257c40c7102035a2ad1324560986727acc250a430d882f5e85744f491bd00b5ce618f7a4470884faaba75d2e1a96
SSDEEP 12288:FpFtCOxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:uOBnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1BC55022D36EC60E6E53A527C89838249D37278961B6253DF0780817E5F7BBF81C7AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd95260a7bdcfc33c33fe5b08cafe92796902d08772be4c18bbe76733cb127a6
MD5 8400580ab8aaac2e7336223ab14b85f7
SHA1 a7288a0113e2cf2f6640a3b28c4f9e5690dd45ad
SHA512 28213cf731014a84bd6e279ada0bd82b29ef60a7f3a987b2404d4144002ae1217a20d4dbc3187b497ccd7c1d8d4e7455e57755c1adcb6d98993a200af4cd78b8
SSDEEP 24576:W7NM9YqZqmWMUkPjZM48Mv6bEhs6nQ/tbw/2Mkjy6Fr7g0oe:W7cBWMpPjN8DbEhbQ/lFTjN4
TLSH
T146659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 17f692217aba40c81998846faea7147e16eda60197ad47a26b72f8401288d96b
MD5 5374e4a71d25338365daca53669a2949
SHA1 a9f89a486aa34adbe4aa26fb9500d138df49f643
SHA512 fa5f6cf262891e4c89ffcfc7084e9cebbc85fa85699d2bde95387fcac27d58cff0a974328f6122f89dde8d822349f7fd40f0913c9f1329d55df3f750dda1779b
SSDEEP 24576:yW6BApg2YuyuNDYTabvcdvNYf8km14nQ/tbw/2Mkjy6Fr7g0oh:yF2YuHNETovAvNYf8kmaQ/lFTjN4
TLSH
T16E857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 b2e522c421b7683f29c1373dd75a4be0c2470151d867f732f9a73c551b663f4a
MD5 2038113662472776c287e22c1db572cd
SHA1 dfdc3c2ebd2d68703c611cd263449196da698e49
SHA512 07eda4c7abc878a1ea8b0c083f20539abc811cf5f384f46902dad7a2d8cc7df76bb2bef74dbfffbe10f4679708d120496440bf6ba40857f5c6e20b89efb858f7
SSDEEP 24576:WAFs06+Omlf3NXEbTodnQ/tbw/2Mkjy6Fr7g0oG:/Fs060lVXuEQ/lFTjN4
TLSH
T1FC65AF2F66AC00D5D07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 37753c3c60fceab208a96176c12b7ad3b648ba745ce74c187dd6de171ed53d1e
MD5 46bfd5f88469d64ef484722ba2e485d9
SHA1 1e3b8f8e2f7e9049133507e788b582c1bb6dc349
SHA512 7cafb51739494863d980294c419b6c4fba7d11b5117f3ea8c5e1b0f1a4e7fee3a168250effc6b9b3d00914cb58eb0c6592bffecf14b8b7f75831a96f713f3fa1
SSDEEP 12288:zCJnJ5D3VkrqzxaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OJnJ5D3WaEnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T12875D03DD2A810E9E477C2B4815A1746FF72386D2F226ACB28A4D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f39b2808fa4501d3f1d3528e9ca7f4f9f3990e08e1089841c7934605e1e1769c
MD5 678066af5d6492bb896dac422bfdc569
SHA1 dc8c4fb46c0c14704d69053f8215f2dd03d43dca
SHA512 b2b0c9a97a517dd7f874665217bdf70bee3c4085cc14172dfa2339d5a5f1c5fafa8f60c5e627c1744021a3210295c4ed67068c4689a9cadc6164b0fde7a81721
SSDEEP 24576:vEPghm6/7IIXdwcXrif7qQncjlP65i3VujnQ/tbw/2Mkjy6Fr7g0oK:Ig06DIKdwc+eQnSt65aVOQ/lFTjN4
TLSH
T10A955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 14b8bce595349aff4db369bcd98277282306be1e7c032e76ba3b55de0607b4f6
MD5 91d496751f0200ef2b4848cb346f5da7
SHA1 ea846746f0e3b6df6b5f8845863e703b3409d0c3
SHA512 bea3aa1375990e9c31b627ffddc8feb8800549869081b82dc1c5c8ba0725ba26be799c3507012e2ca5e8d26abeb83f86fbd4c7db30b22439aa3cfb29fad4a031
SSDEEP 12288:YEP3RSuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:zSunQ/tbw/2Mkjy6Fr7g0oq
TLSH
T19155126D37ACB0EAE52A517D84918145D373F4A12B5267EF2680823D8F7B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 c287a777251b5fd321ee13fbc5cf73afb076f4091a9c2975619854796ffbc00b
MD5 75a37705666fbdde7163fb9094fb5516
SHA1 1601294b18c2014f4a78c5d9c1639fe622876db7
SHA512 0d94b2c42917669dbd78c96db476af92f81ad5937553b3c258d622184b6380d226a49bb7231fa0d1fd932ccb87c1f5428b49813ee8fc219f7729195b59c8f761
SSDEEP 12288:8jkyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:8IytnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1F86512187398F4C6EA7A06788DA381919B367C506F2193DF6280B23E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 9f1412992cfa057d7d132cfeb74cd2a7742ceb0ba34403178136a59271b6b4aa
MD5 bc995605838ad85ec8645755b25ab6f8
SHA1 a49ee03e17ecef35dd07cfad52151af06744c9e9
SHA512 d6195211e5eb438cd190638fbd3af88c14b932db9ef8fcc92ad35e8c338209ec800b4a1318b42509cd713f98bba21ae8c11446260729f1a7c174afa6514eeb1a
SSDEEP 12288:30hGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:ExnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T17B55236C3625F89BFE2706F448928542973B09D17F9163EF36886239CB7D3D416B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 039cd4e4961b3707c074a85d42ade149936c08393075286008f0809fa5942849
MD5 3611f86aead108f8333c4d736d11609d
SHA1 2f1fff430656e85c5025b768d7384633d14fde98
SHA512 7014576aa6c84098299c5d7c47e6edb0ea4ffabec80a760100801e9a88e8f93875e06dd99cd05df5c1de046035aa8bbef88c65ef7fe7545b3d20e7da2340e4ee
SSDEEP 24576:mQ9MxZKdcz9dw3SnQ/tbw/2Mkjy6Fr7g0oO:mVKZSQ/lFTjN4
TLSH
T14C558C2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 efc739619743a2ed83492113446b98466641a2ff6f1b51fa639071cdf888484d
MD5 631600fce806292fe6f27a1b1f9cf7af
SHA1 41e2a88e27595e98a8845bac1a5c9e6aece0bff2
SHA512 850f1c3b8b7cdfa7dedee9143a361454436132ba9bc3df1b40ae7d469e9cae94de6ff7f33491c22d8b93c3221540ba03e0cc98b051f52d24374703c51bdf2d33
SSDEEP 12288:7yoKo20Rple9pnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:7yocSApHnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T11C65E01FBB6990A2E136813C88818645E773B4706B6263CB6691C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2c119e6b3b766809846705bd477b9ce7d7b87d77c8dcf5df566da79474c7697d
MD5 1a32f95e5523b005a6ad754d740b1a21
SHA1 e1c89c398037d908c76bc3667804c4e8019a72d8
SHA512 71e05a6119b0b96691bd6d0578ed8f8472c7f0e8f45ca37ebe12c323d56e2e943fe39fb1655c80a4b1d1af23648ff90a1e4a5eda3ccbdd50396d2976530d5cff
SSDEEP 49152:NWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKHQ/lFTjN4:t0zuNIqLm
TLSH
T134A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a725ee8f21cbfa125cd0dc27e0167c679488f7d338a21fe28b9877ee2d96394
MD5 26ab5b35392c4520f530c339b3acfc0d
SHA1 734b60f6a79c397c10a2b81a35adf6cf6438cd6a
SHA512 6058f39f346dc3b6671a184c0fba0f364fa54884418c7dda09269f9e50e1b16a12f1fcbda39c7cf3cfc7d7c69f39d69e544823e613b34e957af04085236725c7
SSDEEP 24576:l1QT7EcpfxR+N5AWAz3ooiYtjMqbunQ/tbw/2Mkjy6Fr7g0oj:ATDxR+N5YzTfjMrQ/lFTjN4
TLSH
T15355B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 25314ea2461a2e7583a8b0d779905ad0a341a5a5d3f0b2ce9059c11c1f12162a
MD5 c5abc96bc38bca511cb6c7772197ad34
SHA1 b07b325b0257ccff814cde0ca7a3f9a1261c117f
SHA512 b43f98ea40350d3848510f9469aa2d165f95f0e371ec7b91c64268f432525807ce754d289cba6787e52a32cadde9e13f42668fcb32a988b66b393255a0b8ce56
SSDEEP 12288:i4T/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:xfnQ/tbw/2Mkjy6Fr7g0og
TLSH
T15755122D23E8B4DAF93352B48962414697327CA2276167FF36C4C63E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 61f77af330106ef9f86381c3702a471d81659536e53e05479a67e2d2c0085d3d
MD5 d2e4f2884c19bc0f34a3c51a38a2ed04
SHA1 01d9af7538e9451c4bc13d6326f94bce9ec7dd8b
SHA512 344e821f1e34adec7d630a6aed7728b4e998f86f2ddadd01be34e2c0bd9fb2ac3a42e2b91c01fee982e4f3473d17fb4ac38ac90c5587a468aa6d0233583a8eb9
SSDEEP 12288:vmw5HEjsChN2BFgl0WDm+CuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMP:OwuHOWFnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T14365F14A36A45CF9EA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-234-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1176-33-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1176-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1176-39-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1500-245-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1500-244-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1500-251-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/1500-308-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/1764-31-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1764-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1956-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1956-44-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1956-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1956-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2132-268-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2132-453-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2132-321-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2188-272-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2188-394-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/3012-549-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3012-313-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3304-312-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3304-255-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3304-256-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/3304-261-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/4124-467-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4124-305-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4192-71-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4192-236-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/4216-317-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4216-550-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4444-303-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4444-301-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4500-309-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4500-548-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4524-24-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4524-25-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4524-233-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/4524-16-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/4744-1-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/4744-8-0x00000000006E0000-0x0000000000746000-memory.dmp

Download

memory/4744-79-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4744-70-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4744-0-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/4792-293-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4792-294-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4792-400-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4792-287-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/4916-401-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4916-298-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/5028-397-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5028-275-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5028-276-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5028-282-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5044-392-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5044-360-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5044-376-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5044-322-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5044-398-0x000000000B950000-0x000000000B958000-memory.dmp

Download

memory/5044-551-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5232-55-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5232-65-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5232-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5232-61-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5232-63-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5496-232-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5496-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5592-316-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/5592-265-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/5960-420-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-429-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-408-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-410-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-409-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-411-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-417-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-416-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-415-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-414-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-413-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-412-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-418-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-419-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-406-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-421-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-422-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-423-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-425-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-428-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-430-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-407-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-433-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-432-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-431-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-427-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-426-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-424-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-434-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-435-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-436-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-444-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-443-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-442-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-441-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-440-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-439-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-405-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-404-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-403-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-402-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-438-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download

memory/5960-437-0x000001E187B90000-0x000001E187BA0000-memory.dmp

Download