62f291460f4529dfaf903f123df99948f7cf6c9f1f1023cf6743e68a32f9c778

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
09/05/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260509-syn3fsds5l
SHA256 62f291460f4529dfaf903f123df99948f7cf6c9f1f1023cf6743e68a32f9c778
MD5 4fb58213958e607e0e0a3e8e75edfa2c
SHA1 f74a713d065d464567987ff810f4ced88b27227b
SHA512 3e19fef1132b29b0480d079c27e599f5d1dbdecb4cbfa66c699f3687fa9926345a4aa5707de4e723dc1c09eea6017eec40fa0e823b50856f0045a8e03a379092
SSDEEP 12288:d1igRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:eknQ/tbw/2Mkjy6Fr7g0o3
TLSH
T11D5523297950F477D91709F51892C6819B3F0D817FE5A38F7B88227E8B393D00AAA385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5652	alg.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
1048	fxssvc.exe
4856	elevation_service.exe
2356	elevation_service.exe
3488	maintenanceservice.exe
2524	msdtc.exe
4472	OSE.EXE
5868	PerceptionSimulationService.exe
5032	perfhost.exe
4420	locator.exe
4064	SensorDataService.exe
2388	snmptrap.exe
5268	spectrum.exe
5804	ssh-agent.exe
5280	TieringEngineService.exe
4700	AgentService.exe
4992	vds.exe
4936	vssvc.exe
3140	wbengine.exe
1056	WmiApSrv.exe
3660	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c16abdefaa90c5f3.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_186109\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f4d8d3bc9dfdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050e4253cc9dfdc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2852	DiagnosticsHub.StandardCollector.Service.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
2852	DiagnosticsHub.StandardCollector.Service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe
4856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5772	2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	1048	fxssvc.exe
Token: SeRestorePrivilege	5280	TieringEngineService.exe
Token: SeManageVolumePrivilege	5280	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4700	AgentService.exe
Token: SeDebugPrivilege	2852	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4856	elevation_service.exe
Token: SeBackupPrivilege	4936	vssvc.exe
Token: SeRestorePrivilege	4936	vssvc.exe
Token: SeAuditPrivilege	4936	vssvc.exe
Token: SeBackupPrivilege	3140	wbengine.exe
Token: SeRestorePrivilege	3140	wbengine.exe
Token: SeSecurityPrivilege	3140	wbengine.exe
Token: 33	3660	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3660	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3660	SearchIndexer.exe
Token: SeDebugPrivilege	4856	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5076	3660	SearchIndexer.exe	103
PID 3660 wrote to memory of 2188	3660	SearchIndexer.exe	104
PID 3660 wrote to memory of 4076	3660	SearchIndexer.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_4fb58213958e607e0e0a3e8e75edfa2c_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5652

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2604

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2356

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2524

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5868

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4064

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4864

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5280

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1056

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5076
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2836 2832 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2188
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2904 2888 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:4076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
Size 2.3MB
SHA256 cdd44144bbe172992c9d0b7f78ca312e4cc799cb2b31dddf37f4531e4890411d
MD5 83545017f07ce8dce21f980542e0482f
SHA1 0f184c7ec4eb79138e684595467a2885edf8d145
SHA512 c74bf032f52e9d4424643cca17578d54ac1a7a67ceed7b7e6112d130c6ccadcf811e13b72c263c6566a5c71340b819f453582411738e1e90789270d21ea9f36d
SSDEEP 49152:s0X4/T3QDRmcQsqAU7BYYkGsQ/lFTjN4:74EDRQDHLm
TLSH
T1E8B59D03F2D941E8D06AD178C746953AEA727C890B34A6EF0790B2592E77EE45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a039b54a26fc5db12c3104629c53f3150999a7f2c1a4bbd3eafd0d3c12849f45
MD5 8fc24b35f7777c94e7fe33d29b674d68
SHA1 87a1684935d8127ef0ef3f41efdf63ee1758857e
SHA512 3d2e0448dc65334e2fab9362b41e1b0fa01857c9150d22a33a262d8ec05be298c14045ad5a0e899ebe89260ef7dafd6cd24c0726d0beeb0dba0022265aa9c3a3
SSDEEP 12288:31XLsswWkxy2lRq2czA6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:lXYfDtczA6nQ/tbw/2Mkjy6Fr7g0og
TLSH
T11D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1911764c6cc52d12cf8421ba7c17cb063446ae780da07126f374544cdcbfd110
MD5 13478abf96e5c2ff6226ec5b3ca0f303
SHA1 81d26d794127e670c60aa51c4b76346010ff6c43
SHA512 0b4491a99551a4729c544565c27cc2de6197ed037ae368a9a4b0829dd0a0d14ea1f950030a47c9c7b018d55f411d75e7a6dbf4f63e348d254daab31bc165f2fb
SSDEEP 24576:60Le5ji0hmxLrMWnQ/tbw/2Mkjy6Fr7g0od:6Pji0AlrQ/lFTjN4
TLSH
T14C859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 001acbeebbcffb09184ecfbda1e702e4a8e88a542e25a702d1f3dc83579ace33
MD5 90e64455eae3e4320ca33e7673d6a4df
SHA1 b5dc0e46969210297cdbcab29dee8292661947fc
SHA512 3783cb62032a83a8a5225e912977ba6d006e7bd59ec387d1fa8f7b654596ec3353147b70803ae018b1093ef61d029ed0a57ea43d0cc24c8fd6b169063d1d6f40
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyu8nQ/tbw/2Mkjy6Fr7g0oi:T/ezSC6vUzPvxHjyHQ/lFTjN4
TLSH
T19D755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ea255289cb27d213c239c3975e82de4d2e8fa66338dcd1fad0a62f513e98ae37
MD5 61f77a6b4a4c266369d6d8ca8750ffa2
SHA1 df35690d2e125c7cc7f608aa2e18cfc9c35def0f
SHA512 a1979a93671e72f55f40e89b881caaf5887bd1f6024d776559629eb02bc180ceede9ded79c88dc7ab5620733cb155c27f28683e23a045dbfbc49ada8376e6ad9
SSDEEP 24576:4VbqPb88hv/l+6lnQ/tbw/2Mkjy6Fr7g0oZ:4VO88hXl+SQ/lFTjN4
TLSH
T100559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a3a7b5d38c57dbecc9245265c1ac4c64b5e1a74e703c4dbab7f2422de77401a3
MD5 e5c656ee85c259b7bdb772348c1cb66a
SHA1 4f30acea2d251a71963d74925dea124ae9054ab7
SHA512 c666f758ae28d78226d3a8c0b1c8732f0fbc27f40661359c02df51573306f747509fe3e26a8e930a68c8a6060659df0f1569ce2307187654f8ce42329fca6b46
SSDEEP 12288:PzqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:PzqnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1B45523796A14F897FF2B06B15CC284826B3B0EC1BFD4AB4E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 783a8279c39c9f16b3fbb4f9377b69266d914c2dfbccc7a3038e27229df5432b
MD5 c44ba7474d4a1fdae3a284cfa23e8c72
SHA1 8b5a11a5cb8c5a769052cc9bdc21ade94a7e22d1
SHA512 42325b97d145462542c0eb4078db378d8496fbb6408b0302aa523635cd4d26baa3c8f00c2de1f0b8fce0e2f3c4937ce2d542a00a4b3e58281feae875ef0b2f16
SSDEEP 12288:reBNUbTVO86UNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:rJIUtnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T14B75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64b083e59808004601c7cd87ddd8398cfe636857778d92531c55af77281d9efb
MD5 da464c1022a835d5b62e79db5d146cd8
SHA1 46a942b0cc4f1569fe5acd6dde5bf8164722c38b
SHA512 c3d84366ff28a31fe1884b2a1235328d3f147876db77fe8409b736dec80fac8fe9c9ebf346e74e7af664f10468854db3e96bb0d26b338e7abba073f278f1410b
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:4QvGAdlCEL8c/yRNw5CvLm
TLSH
T1E8267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 431e05a4b0d30b36e3a2cd5537efa8e30061ff44a2dc276cff1a75dc1872f325
MD5 838c85e9e2e848bacdbdec88be12ca2c
SHA1 ede7f77c87836ea41ade3225ffa2a6fbfe29a3b1
SHA512 1714c8cfac88c20d8e0c1481924b3e2aa1faba6c778c37a7858799eed510e93dd2fd97e88c2c4a06a5cc7d6f86514ab3a5621204a5baf8a4dcf9421f4cf2c0d4
SSDEEP 12288:jAwSfxL/2Dc39DLLmt0LDQewsAjLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgY:cQewsAj7nQ/tbw/2Mkjy6Fr7g0oi
TLSH
T16875E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 64eb2f3a8b03ee67ad63798ba8154d17d73ae2e2b6c4c4b6a6461974392fa170
MD5 a7fede1eb6e769a9dabcf1cd2233efc0
SHA1 e7a2876749e09dacbca9fa090bd807e0749da662
SHA512 257989f09eb3579b52b04e80d06de3aa977a592a20be05e9a0e20780e3fd9d988afa9a8c3a574e245d7754234c2551aa4af49584bc1decfb5c39f45b2cefc076
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYL:7UEtQevvqc2W1cpV2EI32
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 709d4af29029d825908a6cf75a40cd89ef838bfa0666bac1e32648baedab1c0e
MD5 c40f8bef7b733d6defbc68438e20f131
SHA1 42e1a4c7f222a59f6f3ec9a9be69c556be3519f4
SHA512 81d11ab0ccc0f5742d74f468d7fbcd512f3adf3e0a71e4404bbd33face395eb95eff30476df3d76b4d3fca3a24bdefa02df455e6fd7ebc68a0f70cf91f4ed902
SSDEEP 49152:8CbRquA/m2yL5zQfFiV+XenmE3/zbQ/lFTjN4:1oqtVjnm7Lm
TLSH
T1F9D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 47b8be71beb58670530410608f42dafa0052a5d9f9faee57666dc0cd82895f32
MD5 7fc1a130b2d81cbd7a9ac1336a753acd
SHA1 8a6f0c632eeb1a88409024dd12fa1ca30e563066
SHA512 ad3ad8d9e1ff1f330251271df0a9688644ae95f134edd0236c5be7d64eac53bc40268f2e02d95225d0bc70ca25c0517df5c3ddba36e22adf76f743474f26d1da
SSDEEP 24576:lAhGLJIFoiwtA5l7S534nQ/tbw/2Mkjy6Fr7g0oR:lAMyFoiq5oQ/lFTjN4
TLSH
T1CD35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3984ad673e4bf27af0f075de46ede1822bbc4fd4a409ef26fdbe1af42be37ccf
MD5 1db8a56152172d8f272c7b160a9d139d
SHA1 e11eb81afc2f5918c9ac0545d05a040373f2e9be
SHA512 8c3aea6ddbb02992acc53fd462825816687316db65c29aeea41dc8db9bb46e34af711b673c1830c5e88a45cc31e4262041d83ab04ab2352b19e32d84f62592cf
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+C7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMi:VwuHOWgnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1FE65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 604ee4f4d6568e752cba798ef565e25c103008cb77587cef1639a83cc812157a
MD5 18e119f36d28947d9bd0b0030ffb1f51
SHA1 793043e495df5511057236e9b105db401f302ff5
SHA512 db1d82bd21668dcbd1fc991088b014755e8603b902b3227145f7de3c93c5187d00a4fc8d0c87fe6b6631b2d3c84fd7aecc95e2ec1ce56702b3a2bac00deeab3d
SSDEEP 12288:0XZ1IybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:0Zu+nQ/tbw/2Mkjy6Fr7g0o7
TLSH
T13655126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
Size 6.6MB
SHA256 e7896c8f45e97ab1cb75e578c95a8daecdd29a3162cb4a25c9dfb8ca4fa67356
MD5 c9bfa4d56ec8ae5543263355beaf2a4e
SHA1 926210e784b2dffbfb38e3d57975862262aa8d6d
SHA512 200ca6f8df1aa66c3a9c4518ad357b28cd50a388fb056af5e818bf765850409edd29e2088e529db31f330a69d92de56d55f352d5f20f96e5b020070262388f56
SSDEEP 49152:oTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxK:out4LcLBbPU7H8SUY/P5h9TLm
TLSH
T1FA667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\setup.exe
Size 6.6MB
SHA256 0b0c4143075f92d88b03f6cf5bea9a262ac3bacb6c0bde4f49f3fa354f94fea5
MD5 f230beb43a8f1fe7075a9bb3dd116386
SHA1 0388f9667ec8e63a45226906e5f82e7de247dfec
SHA512 941a79f961bdd3aea7a7597a385f01e8a28806ecd047d1148d28a6759dec0723801901fcf17209286ac09ecafdba416ee3acb3caffebf7adc07062c16f46f198
SSDEEP 49152:wTEoba3y9bVILkmvguhO4NOP5PlcQKvfjBbPZu7H4mYwrjDDSNdihLuZykH8mYxK:Qut4LcLBbPU7H8SUY/P5h9TLm
TLSH
T156667D53F3B500A8E05ED9B4CF3956229B757C4B47B092EF269436E11A72EC47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe
Size 1.9MB
SHA256 41f7467898db60fe584e25226db28e837b028952d6197bc56f556281d895ab84
MD5 f23f071ac0d66931fae45dacbd66c6eb
SHA1 aef21fff127442edb0a4f5e9e1f887d2fe066ff4
SHA512 91145f5e55ec7f14845730bf96dcc648abfb9cd9e6c0f4794ffb5b92ccc80bf6340ed30e1753dfdfa6674d8fd943f260b12106002343b41ce9d4249f3f257e04
SSDEEP 24576:FXHhwegnv8593atGFEtDUeRQt5iMaJgv4W2E4PstnQ/tbw/2Mkjy6Fr7g0oo:FXenvGq2EtDUtLuXW2YQ/lFTjN4
TLSH
T11695483672F300A9C45EA0769F56473196D27CB1CFE0D3DB8241721A1FB29D47A3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe
Size 3.3MB
SHA256 b8bf82542246b5353fe25947dbc9cd0ba4cbc3be81f1c79731275948f982e5b7
MD5 3dcefd87b7963c35f06c94f72c38b3c9
SHA1 fc4c4daef4ee449d20888670414ed5647700aac0
SHA512 df58355bc7d5c9127eb7f0817ab2cc92e0a36119f9d44db2c0386ea17ebd7ac34332907e46325da99eacd024c792207d075861f1bc5346931e5c4c7ee3aa27f8
SSDEEP 49152:VFKbxUEEhQ9gsfxp6MZEtEYVnNKkNIHNNlCX0cXz6GfpksGLP3/NnQ/lFTjN4:BKKsnZEBSkNIHNNIhj6MpkJMLm
TLSH
T1F1F57B13F29900E8E05DD1B8CB4A9622EAB2BC850B3576DF0650B7562F7BED45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
Size 2.3MB
SHA256 d16669c08abb9cc0efe3e2df41faff6c0d3f90e9d5dc0b3c7548edcf4663d1fd
MD5 4b2912d4a545243be670df67743f29d1
SHA1 d2c5f5d40239def8d1151cbc1c5f4e30d03ef33b
SHA512 a9109996f5159fc22bbf04098d9ca02d1c29c577fcd323f44cbbe0f74bd426197af5fd06300968a2fa914af68d01edc4225595f4fa2c8f3533024e13e51c1837
SSDEEP 49152:41xWevYkaNRxiCtSGAeA4msvxQtghSpOaQ/lFTjN4:qHMSGCELm
TLSH
T179B5AD07F2C941E8D06AD574C7469236EA62BC8A0B34B6DF0790B2562F77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe
Size 1.9MB
SHA256 fe458c80e139c71d8494e6eda5b9de988c9287afe2c281425eef57f770b94519
MD5 9b04a8d86aabaa8a98b550e3e8b96688
SHA1 7926b3efbfa5c7530c5f9fdb526c87986860e097
SHA512 7890f21434d3a5b9cb5fd89a5f26f83d8149352709913419f53c6e5a2ab406ab099ba8bf65eeb29843235d0a45084d0d6e696ac4606bcf4fc4fe779a2baf1dd5
SSDEEP 24576:zvA5Wwt59ZKNT4cQywprNzP8AqYUI8byGrXP3xvHrJnQ/tbw/2Mkjy6Fr7g0og:zvAl59A9GJzXq9I65XPhv1Q/lFTjN4
TLSH
T15695BE13B29940E8D05EC1B8C7568636EA727C820B34A6DF0798B6592E7BFD45F3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe
Size 2.1MB
SHA256 7844e3cc1caf6de4b9dc31d9f02df0ea1c17c03c6cb5f778d0b8a002b1c146bc
MD5 a5844a3a643eed370d10621d3eed344f
SHA1 782ad972e3a4f21d787c396ed723c55095cf4a44
SHA512 7e96080bcdb6244f440177b974882334e0b0c8aef632ff19a0a863bb1043b9a7c596fe160824197106d4bc9532cbac20a9cce59a072fbdbd8b9490102731162b
SSDEEP 49152:hXZNoU5kqRZvTE9lDKGWfMh+Q/lFTjN4:XFZI9lhWGLm
TLSH
T1ECA5AF17B2D940E8E0AED274C7668522EAB27C410B38A6DF0790B2591E7BFE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 1.6MB
SHA256 613136e9b57ef2273dd53ae7c7d997cde834b69582a6031e07e228cc7fd5feca
MD5 1d8500fe15f3c97b8d7c31c5685de739
SHA1 6524ef1931965ba2a7c742028010a71e71279e19
SHA512 54370ee04b6af2abe142970c0846a32d9a3e6b2b04a010b4486028a2dd8e8f56585901bee1d9327e55b2a370221a9dc73b2ea0f1fbe82eca2d8e72b2c66f764b
SSDEEP 24576:609xwCr/8dMJlrNs4ffuTdskLV+gvnZlonQ/tbw/2Mkjy6Fr7g0oF:60FrFp3nuT26V+goQ/lFTjN4
TLSH
T19875CF17B69941E8D02AD5B4CB668132EA727C810B34AADF0790B3592F7BEE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d036b4df82dfe4a3e5a98ae5dc8294d2c0ed3780c0989fcf9ef5b2f199e6ff5e
MD5 a5ef8faf2a613c2f06d47443dc0dca08
SHA1 4bfcf71cf32e9abf3c11662f8221aacb3c649426
SHA512 f2e3b50dbbff4b86a96dbe3cf1bb9b72482811bd11fb04a767876bbf21e24ffeffca67e74e6a7f5f2361e3e8af236594b4095f451da725afe7307887a1b067e0
SSDEEP 12288:uSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:uSnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1D45523697965F98BFA1706F14C828182A73F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a053b33f00564cc59c7d17034c1e5c4871e1b95087b17c5424f7fb5faa2f1a11
MD5 bd87a705c5702fda56278d63b8a264a4
SHA1 908cbc84faf9a88031c18bbbaf6bebba70264523
SHA512 4e8f3f14be5b1ed60acb90d931419e9887632df5f8576466cf86b96ef92128d95ac234de3abb9444295d171ff18b02ebc60f84e900188619ef1eb61b3d385b55
SSDEEP 12288:p/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:pfnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1935523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dd9bc5c67875aebaf20e2e71ebcddc2cacacbba2e45b74180eded97460edc2a2
MD5 71ec4e6ebff8cc71bd0ecbeff1d53043
SHA1 2f8cb5a0e21cfe4f392bc8f6f59a89ab89861ab7
SHA512 b9ed96e613d3812892962b56e3f16d43a44496aeff379473178febf5a0c51f9ae325c998d24082eeebf57305896fc200ddd7b260e1bd3647125518906b14b99f
SSDEEP 12288:P1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:PVnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1435523697965F98BFA1706F14C838182977B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 76a475329116ce4492037675082734232d5150701ecfd7bd03ec6cad6b560838
MD5 e4fd8ed6e27b58d3710fdbfc8e1eb1d3
SHA1 df18ae10085ee6224c373a63ec7ca4d48c0ab6da
SHA512 2d24f4c1a766bc6f0f0972865fe37cc187abc456020eaf6738bef59b75a0181b3abe89c606ab82fe0de42d5cd0f0138418b0751fcdf623af6e36ab6b57141863
SSDEEP 12288:NVYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:wnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1405523693A69F4C7FD2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d38be2f363e5518430c838608b2cf4921927a144fac76a3668fb091b15c50991
MD5 39791550517d8b7cb021bd1219d08753
SHA1 7314ff63345cfb6fbe9248ed2a480c580704cd9d
SHA512 9ed55de19ae2a0486a305e4fce2de59975e36345017479e9f01c711bbea709abd308235c8cae03afceed7d51570300be4fb3f145b6e08111319cc9fbcc595eb1
SSDEEP 12288:cQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:cwnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T12F5523697965F98BFA1706F14C838182A73B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 295deacf30092b986169e2e6397fc6c1e1b1fe81cd673c94b2c6257c212284c5
MD5 caa194cda5c1d288c137b420c91185a0
SHA1 018f61e4dd6afbc142870a3c8c7189cec3b58ad9
SHA512 a5d7b789332572c74b916ff82bfb5c7df6430898e07ba316152ff8013bd617f513d7c198468f5aec2c011665d88310fffc3f03c1ecfd8949082f33ef3ab3bf10
SSDEEP 12288:6TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:6DnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T10C5523697965F98BFA2706F14C828182973F0EC7BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 208ce3593612fbca9f3091bfcb154773aafe2498f3fb75049e13a547c32c2035
MD5 aaa130876e11be41fb7acc90f5b66a9b
SHA1 fea4a635c95f8c5ccfd079a24fffd4acd647c062
SHA512 6d6255066626dbad80adc68b851e5d073cdbbfab10750c2b690fbac0ad2ea0c3046e85b0ec7844d6093d8e917b063048ff52e45e3484710798484d3b2bcd5f87
SSDEEP 12288:f3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:fXnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1535523797965F98BFA2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b2058e466ca2ac5d063dc40209de7876fcbc7d6cf9a809321299ad458709bae0
MD5 d81c16ad8b83bfff605a5320b0b98071
SHA1 ed4d7395b8c77c960df9ce5f9458b91735ead7eb
SHA512 131cd9bed6b7affeb67f7b69a5b907a993a6570773a1aad1a809f00234c815649817e07e1f1f7cb92f7b2c163e536c2c8acf448108b97ba346e6796ea335165d
SSDEEP 12288:XiZwbDzzFEoS2cPvyfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:SZM3zFVSO/nQ/tbw/2Mkjy6Fr7g0on
TLSH
T12D7501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 26ab971a6c9b90d59e38270f7bfda314738a5a5fb109c7fc0dcf21f722a438f1
MD5 d74362cfe510b5dd12baf54af18fa85e
SHA1 937f203619357957561d68d12c77d68e759be6be
SHA512 1216b8de1529aa8ed33f3f7c5d59b7d7c258797728cc234dac2b5520621ce1b512963b6f72456bdc58101f3b01f1728fea04c6e6af8c772e0fbb979bf01e17ac
SSDEEP 12288:YOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:YOnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1255523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cb14ecd29e47b6ce5de403f3d60a0bef21c6be1a7c6a0072a1e1e11d19017bf1
MD5 16a136fdf457331280ebae1535ebbba8
SHA1 0a4a3e832aab95b674dc30d843240b51412bbfaa
SHA512 22cc2e7dc0ea22c088186876d786d83a4c6ab332d7774e0f502b857c3c76c9f39e447f130785589ad3c8e9aeba86700d902db87a6c30481e3e7507e31bcd9de5
SSDEEP 12288:Z6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:Z6nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1F55523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4a7e534e0a97aef04f6a6d450d33e7889b96f60a2563a278f00b8d01c0ca116f
MD5 d2cd5e23f0f26e110016e536881bf1f4
SHA1 d9cc1a6a73b6442e3cf17ac6a21114d11d10503d
SHA512 546dd79a2bb8e80a0b0b3f66dc60c3800031ae41467f59ad474e4df2e939f5e5ded5d8833a1600fcb188ea1619cc6b3dec3fbbdb765b072845482c6a83b64810
SSDEEP 12288:1yPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:czyLnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B465021773A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 46ceb25fa769074278640cab9ea7b6cb67a258673247ad5370c8fc142c59617f
MD5 ed1db2bb34257c4c4d2d3f06922fad39
SHA1 1cd351b317e40f219b0b51c47c99668ed76fa7bb
SHA512 e93799cb90f6d5165d756000e83051257f376350be43ed7557b0f90c100462cab0b8b8e95ef198f7ab45c9eafd1801d97b13f236ab4b9e5a6bada3d7a87a491d
SSDEEP 12288:0OGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:0OnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T16D5523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d05c98cb641012bc5653687aed70da7a0755e5985163b015573e80499b7624d4
MD5 2ad4fa4118d5ae27362114bb5e1a766d
SHA1 ca744b49b97efd8af3a796672d10d9ff95b0650c
SHA512 cb4d1811fdddf731815b1501e1051332f1694b4d3d1082da1687cb57f536cea3e109b2cc0478532be1f721e2675616e2313066592a9a48c3f349c8f8eb00d19a
SSDEEP 12288:dOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:dOnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1375523697964F98BFA1706F54C8281869B3F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1f8263d9560a9e3d6fc76fd5483d4e33cb22e9768f5d2da9e0629b4621b204b9
MD5 dcc2214bb9c3d6b65800083d277dd8a0
SHA1 dd0620110c1f3bb412c264ebb8c3ee11f6950794
SHA512 60f488e64706446f04e35672ca15d917777055ff7329dd8fb32fb9ed5d5476d02cb5f704d440375f3a0d322f4dfab02f3846756102ea217a095098b5c6ee4e33
SSDEEP 12288:zyPz5L8bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:+zyLnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T14265021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bd54b359f94e86f209c3589f03fbdf5ebfa575ca6ec32f71a13ec596cf4ad2f5
MD5 93d7a6b7f1ee9ec0d4b768cdbc1c07e1
SHA1 ed60e35bbd39ca589fd13a6d3dae3b367d0425dc
SHA512 cdaacf40de1b35bc809297383b6efb08cb58de2732c2bef09a46b2b2135b762826dd564cc9863040c6e2c80febbc0294facfe4858312dfc16e71fe9005e81e44
SSDEEP 12288:rssf+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:n+nQ/tbw/2Mkjy6Fr7g0o4
TLSH
T12965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 220b744f2ffdb99de229e506194f92981d14b625080de4a8cec39ffe37b32e76
MD5 81721e4890bfe1524338d13fa4c90913
SHA1 c0c71897a392e0e88a72d42547c0b199ea33776d
SHA512 9863a3408aba4814582e624373c5bd84392be3185f97a79c4dbd396e35d3cc5d9118358d6d4cf9084178f664296709d1f0876fab1ac1c082b9d87dd601538346
SSDEEP 12288:YOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:YOnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1935523696668F94BFA3B06B048928111673F0EC5BF9193CFBB082269953C3D41EB6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2114cf60fde130e84cb3199c92dba61b2ad6deed2636e3730c8cb95dca42eb23
MD5 4c61d2782bec49b9e6f8aeb8cbf6768f
SHA1 cbde5feccd2a7032c2092cdcfbab319470c422cb
SHA512 5552dacd59d70c7e6c4832192ea2e81a77dfd45e39fc184a50be137fb887c7836732e9e61ca8e25ab8cfbe2c92d040e879555e1330b4423d6778f4615f4ddc14
SSDEEP 24576:g8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTC0nQ/tbw/2Mkjy6Fr7g0oB:BRZwQCyiHiQEaaPnMdQ/lFTjN4
TLSH
T1AE85BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 41f7cebdf31960cb38a97cfc7c496f69f47c58e14ff4c54c8347ff98ea7a31ce
MD5 1048fcc2f63e007d394c2cab40409fb2
SHA1 c9d390a508976637588765a25af7bbc939f4c7be
SHA512 e2782f6d181570164dcaba3ce89fc7a30171ae545b77f7530e4cb97d105b47d69211ca5a13c66f2a432af0836b0c1115b5ea2ef36b7b0417494514116cb001ab
SSDEEP 12288:XbxA1U7KeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:XbxA1UGenQ/tbw/2Mkjy6Fr7g0oL
TLSH
T19955123E26AC24E6F536967D88D28106D3327C56676193DF2284823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0bc0e6add7e289141de259b1f8d3e15df35c5503023aac5a61129d3df3948713
MD5 93312bde1d1cb3e34d9a737d49015cab
SHA1 d1cd42f64fc020e593539e2463947908a23fbcbe
SHA512 9011630c058b41acbdb385ffff108d1a38de8e7245683b470dbf37be2f26ea0a461f5a827f53a7f1089bd43aa8a5ea5e86204567b6adf510a893c9be035776fd
SSDEEP 24576:fjsmP0yHaqrVqHra44KDzMsrnnnQ/tbw/2Mkjy6Fr7g0os:fjRP0yHfVqzlAsrnnQ/lFTjN4
TLSH
T17F45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 37551ce7755e7a630d1887342cc6939c7df122f8982e1da86a69d73e710b0c8c
MD5 4471bc5ca66ab6d30a0c022b1ca506cc
SHA1 767234f48aa43101eb29711c58a816d40df50469
SHA512 b230d3515d81199f29a84261888123818ad5249a29488392a03a8ec6751a7909f6b34d1d297d91b7e5ff4b1004b1350a55d5fa1d440f53309e25f4420cda1fb8
SSDEEP 12288:fcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:fcnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1BD5523697658F98BFE2706F54C828142673B0EC17F95A3CF7B482229967D3D40AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 6c9c9e7a9c8fc816ba7baf10bda750514344101f19ff6f1ce06c7b14e5750535
MD5 fd68c4ac62f02abf9853846e5ad1f28b
SHA1 5574bb0cf9751772300251edfb8bf1f188a4302b
SHA512 61f68992a4f1d8682a452bd50f1177e016e2fd8c80ef838e881885fa95bcd6f09eff274fd9826d4a4cc546858e5a5dd20120de45287eccdc247423905d350d99
SSDEEP 12288:jOb4A4LWO+vAYFT6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:MwLBUT6nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T12075F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3974b44562bcef8353d318f51320b141150e71f69bdc4a8d931ffc617da8a0c0
MD5 27a403b2e525979aa9695cd2bfe8f4b1
SHA1 8060a94684467d9099aeaaea81cf728262d6cc90
SHA512 abbe7e386facd4dc48ab05d9b5b86367f7bd061d4263b78c4b1838ce83a2866b96b2525fb8cb15e69af45b47a07688c17a311b4700d4017f2532879b3a7022bf
SSDEEP 12288:U70VmuIYNvUyBpJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:hKYNHjnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1DB65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3369c1f1c8e2f2e1a972ce5389d29ceb2a52590913d448347a6eb80b669464de
MD5 112af441f817ad3142b19643ea7caf7a
SHA1 e1fee81ce44cbc52bb6cfdd7721425e0954ba22f
SHA512 98ac577b0aa2c3d665061120a06fe90f09cc647c8e461700f1528290a31fa7a42e2b86eaa71e333f76fe198bf3921a0bd6d8a47c4a1442ff957b0fc29c038fc3
SSDEEP 24576:VnXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKG:VnXoJJYH84VVS6AmEcJas+cHBjSSKHPF
TLSH
T14A65BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 90aacb9b9c74a938e704050ddcfc6e661ebca029813f72695be821605bebe582
MD5 dc1e7c0a3f7a5a756e43180a99447e8f
SHA1 34546ba23ae9516d7fb5d82ca36d90acfdcad8e4
SHA512 804e88e2cc6460cb6f3557b05ef75a8494f9808edbf967b9f2e51fc184157d047ab329313241e8062f73b359b8f90c956b76c592c5f6c2d99e6270379454f316
SSDEEP 24576:3v7Xbxd9Tuycf8M/TYlSuxwr2PCBnQ/tbw/2Mkjy6Fr7g0o5:3DLL9TuJ0M/TYW2P8Q/lFTjN4
TLSH
T1B6858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ebaebb1a94130c1c547a8ba47d10bfa5e8b11cd9884d4d5afc3bef2e9571280d
MD5 1aab3827565d44ed9858cf9e74036f3b
SHA1 a28f0a409eddeede0cf55882b1b538ddafdf18f7
SHA512 772b64f298c28c4a7773c153f0a9e7b6ea695f9aa7b296442f27841c30f27a5ad450db6f9c9a9e284acbb0be669457a176e835beabc0c3aa16cf3497d9d21643
SSDEEP 24576:WegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10w6nQ/tbw/2Mkjy6Fr7g0oZ:WngOJOmPOHh6Q/lFTjN4
TLSH
T15F55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 50107f2d7880d1c9f0f1969c6d29a56b37dcd7a518084154c11c0cf5d3da8aef
MD5 3ed090e4988af9f9edc1cdf8b83a851e
SHA1 dafd5d59abeaedc124d745edcc9e8e20af33d8d9
SHA512 77d59449c425f36cd41934b12a4ca47d3415a52d6f4576b80ba25f778aeb41c1f68238b954f66ad2722ac22b9a3805d49403b57e5fdba57c2c2217485dcaab7b
SSDEEP 24576:3LJnJiTk3R3waE4JrO8nQ/tbw/2Mkjy6Fr7g0od:3LJnJK8R304lXQ/lFTjN4
TLSH
T18675D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4cbf8b38f56e2f5648b7fd9737be39c870bfc3852928ef656229a47afdb8d1ed
MD5 85641bb900463459e140ed899c6b9b59
SHA1 8db5deda687a3cdb90babb4948371b81cd4a6286
SHA512 e48690acefadde2607298a7f9e213b60f0f0c5833bf3fc57417c2d2e707f06c1b9a5dc1906923face05e59ad0a44065a59b4baa7772285572fc0b5b7d2d7f0b0
SSDEEP 24576:CA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pvnQ/tbw/2Mkjy6Fr7g0oh:99GqCzDScAZmlvTcFg8Ph6NQ/lFTjN4
TLSH
T1E4955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f2dad1c3e4b3d4aad0938f890ef6a102a5b23a235688d033fc90a1c221dbc257
MD5 0b2a5aae663230a9b8a04c74cc538148
SHA1 f8b171801ed95cd0ccbb6c14cb26bb2e3d3910bc
SHA512 5b5ef1c4e5dd3618a4348c138818bc8aa4d920ddcbb73e6a30584fde40c3bde1847ee03c4c6d0f47675190d90acbca7ae693686ca4fb7e48ebfb6bcfd96defec
SSDEEP 24576:zlYJeXm5jUuEKnQ/tbw/2Mkjy6Fr7g0oe:zlYJeXmRUuEKQ/lFTjN4
TLSH
T15055126D366CB0E6E22F41B988928545E372B4A1275163EF52D0C27D8F7B7E41E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 913cb94b0a5bfd01ca3921e2b8ffe0644ea15f4ef3bf8875f88a4371b72f5143
MD5 f8dd2a9b3884d69eab26f24798dfbb4b
SHA1 6243051ac2ece9049508034b8510e7593d0addd3
SHA512 603cf97bf7cdf28f815fd682abe2a9c84dce04edc3d499ddd67d7555d8f515d19ab27d5c0b8ed578aae2037065388eec2db8717b3d9dbca1f10c6faf68fe03ad
SSDEEP 12288:gFu6kynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:gUtyHnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1DE6512183394B4D9FA7A06788DA381819F3A7C50AF6093DF66C0E33E5E3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 52f8b11db8ae4c75b3777026391ce7a8845a8fdd337d16cc58913a1ffb1271e6
MD5 5d3c60576c071c6b53eca94da6ddc075
SHA1 0509ec3c32ee16a3fbc83f9a4430e6bee0dce6cd
SHA512 8b91ce08fd8da990ce0f53290e486fe218886e37207dc5d20342325b2569741d434a6e8f192e910cadd8caaf83c50da9afb08d78c02500a8dd3876f013b33e3c
SSDEEP 12288:bP6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:D6nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1A155236C2624F49BFE2706F448528142A77B1ED17F91A3EF36846139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 32d98dfcfdde012b3b243601519fec1e637bde7b683c172d9fbc1e9809ae3efd
MD5 3c37494bc26098794825c325ea6d0f08
SHA1 445c6fe861f87e171739539c1bdcb092b5241555
SHA512 8f4e58e2fec037ae8e6b8d0d19b8b43f22b576f26b234aa8dce0638de679877e2a0e9c0c32fe1b59ef0fc6deaee5d19d7ca32a8290d88c723c7dce6aeabe1910
SSDEEP 24576:IC+TyQIu93VAumZr7jmUnQ/tbw/2Mkjy6Fr7g0og:I/TfIq+YUQ/lFTjN4
TLSH
T15E558C1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 b13802e3ff3b96a4166ad7c5c86de28c65f73af09145a6bb408e63db538c9ea7
MD5 24e2271d58332c96095a0bf2f5326810
SHA1 611a3dce249defbdd2792b92659003fb9ce66e8a
SHA512 6c6fffdf4c5085d84c91437de4fdb43d42b17bbdf70797e6d3640fd4891420ce3747d2eafac003cf48c23f0b12a4b2caa60728579f1e296bda4f843396bbdafc
SSDEEP 12288:VcyrWOstaa3kcszGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:gLQikZjnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T19065F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6121783d41b1a958ccfe41ae44a8fd61a705e6c2b0006bfb1f539f2891697f26
MD5 26a9b3c19af1ecb03d3154a3e3a51970
SHA1 e7d4219c135c92ddd54703a903c4d16078e0bb3c
SHA512 94fd901d60d1d41aa071166706fa0f98d1e517c82d098818ceedb20c6a75205ea7cd7bee8c88111a550403a45e602852ef5c69d883c3634bce8bc293980cbbfa
SSDEEP 49152:/pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPWQ/lFTjN4:kpC7b4+80GTkqLm
TLSH
T166A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 480c497570497fd75b4c27652b470fc89beef7e210f0822de48cc12dd112fd33
MD5 94f9ab3ca53fdd0406432d72364651ee
SHA1 fa3e4722f9347db92e8e549b99318b42cff61cf5
SHA512 7dbcd86d4bafbda03685fab0d2b11c753acb0bf95348fdc02e89d9558ea43bb0671362fa25e48ef31b9224ba1d1b5aab9c2abcb5dbebbaaefcc7abcd9940ad29
SSDEEP 24576:KSAwJPE1IDAo+4Kt+l44135UQvnQ/tbw/2Mkjy6Fr7g0oM:KqPCIo4Kol4/QvQ/lFTjN4
TLSH
T1D255B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 bd8f75ecf3a4561819bef226e48a64a8e73c5601283b9656c444af163ea7de3b
MD5 0c058225be1ff04e3348fe396a7fc153
SHA1 b9af85297a8d5101e1e478300d60e0966cd17a13
SHA512 8d5bc7f17b81eea29b0b6df0f154fc928df8040b43baccc21f125d394a13f7d73ae1e8e747cd6d9b51a06bfd0e3c43d436673eb742843218913fc58c9c64a77b
SSDEEP 24576:zyLXPLcf94t/nQ/tbw/2Mkjy6Fr7g0oe:zy7Poet/Q/lFTjN4
TLSH
T1B075E03EE66C08E5E53AC27CC6A38506F672389D037166CB1A9491791F7BFF46939B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 3e9ba532dd7ad5c70efc4bcc3e79911163f49c19700936db02c2c1aacfe95a15
MD5 90c41d69eac6eb6984e5334508240e6d
SHA1 6d9808c86e7f8bb4b4687964a6d9382dcbd4faa5
SHA512 7551bf458f02c6069b7a58330cc18260b1836921eec5c1b746ddc2512e3610f25b5a5eaa1e0a241c2866db083690b0460c7b94ee6570f2d8992ee45d9fa5b293
SSDEEP 12288:w9lyvj3IkxjbBzGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:wWv8qjpmnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T18E65126E66A4B4D9F53A0274D863811682767CB227A4A7EF36C8D57E4B393C0953FF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-42-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1048-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1056-443-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1056-356-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2188-467-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-469-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-462-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-466-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-465-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-463-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-464-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-468-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-442-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-461-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-460-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-459-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-450-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-451-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-452-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-472-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-453-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-470-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-454-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-444-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-456-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-458-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-457-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-471-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-455-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-474-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-473-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-449-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-445-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-447-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-448-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2188-446-0x0000022E02180000-0x0000022E02190000-memory.dmp

Download

memory/2356-211-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/2356-45-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2356-44-0x0000000140000000-0x0000000140266000-memory.dmp

Download

memory/2356-51-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/2388-128-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2524-70-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2524-321-0x00000000006F0000-0x000000000075F000-memory.dmp

Download

memory/2524-301-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2852-328-0x0000000001530000-0x000000000159F000-memory.dmp

Download

memory/2852-332-0x0000000001530000-0x000000000159F000-memory.dmp

Download

memory/2852-25-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2852-23-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2852-22-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2852-16-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2852-108-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2852-319-0x0000000001530000-0x000000000159F000-memory.dmp

Download

memory/3140-477-0x0000000000CC0000-0x0000000000D2F000-memory.dmp

Download

memory/3140-441-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3140-353-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3488-56-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3488-62-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3488-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3488-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3488-66-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/3660-359-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3660-433-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/3660-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3660-417-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3660-401-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3660-478-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3660-365-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4064-322-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4064-127-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4420-130-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4472-315-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4472-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4472-80-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4472-74-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4700-171-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4700-164-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4856-32-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4856-165-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/4856-38-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4856-40-0x0000000140000000-0x000000014025F000-memory.dmp

Download

memory/4936-440-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4936-350-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/4992-346-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4992-439-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4992-476-0x0000000000730000-0x000000000079F000-memory.dmp

Download

memory/5032-317-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5032-105-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/5032-100-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/5032-126-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5268-118-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5268-318-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5268-124-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5268-129-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5280-163-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/5652-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5652-107-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5772-0-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/5772-82-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/5772-8-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/5772-156-0x0000000000400000-0x0000000000547000-memory.dmp

Download

memory/5772-1-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/5772-152-0x0000000002520000-0x000000000259A000-memory.dmp

Download

memory/5804-134-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5804-140-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5804-142-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5804-320-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5868-316-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5868-89-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/5868-97-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/5868-95-0x0000000000570000-0x00000000005D0000-memory.dmp

Download