c535002775af52c4c26959e6e5328b31a4cd1a77242e9df607b18bd19d2741de

Analysis

max time kernel
148s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
Size 1.1MB
Sample260511-elaseaev4j
SHA256 c535002775af52c4c26959e6e5328b31a4cd1a77242e9df607b18bd19d2741de
MD5 8861e09fc30a4378c6db9dc28ab22c9f
SHA1 dbaa625404e917e4a14dfd68374620e4f1b2c2ec
SHA512 90b85140c266b1c6cfa86e7996824a51cc76013048253444dd1d8dd5260a1b88ec1d69a16108d01d28268285b6b52b10ab86d3ebd02bc907f78091ab306af8e5
SSDEEP 12288:8AKJr4IWNFGp9pR7fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:BK+IqF4p7fJ4yL/tNCJPXUQrPL
TLSH
T1D7352A5032F4D926F2F31B743ABDE26148BA7E90AA38C24D2502565D1BF3B40A56CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5076	alg.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
1248	fxssvc.exe
2388	elevation_service.exe
3116	elevation_service.exe
684	maintenanceservice.exe
1856	msdtc.exe
3688	OSE.EXE
2644	PerceptionSimulationService.exe
2560	perfhost.exe
672	locator.exe
5116	SensorDataService.exe
4132	snmptrap.exe
4300	spectrum.exe
1180	ssh-agent.exe
2228	TieringEngineService.exe
3360	AgentService.exe
1872	vds.exe
2624	vssvc.exe
4656	wbengine.exe
4524	WmiApSrv.exe
1304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a3a2d0aa7932a944.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\ProtectUnblock.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DXError.log	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Logs\DirectX.log	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037c3dddefae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e9833dffae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000470241e0fae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aae08dffae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d8fbdbe0fae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ed031e1fae0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
3704	DiagnosticsHub.StandardCollector.Service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	928	2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
Token: SeAuditPrivilege	1248	fxssvc.exe
Token: SeRestorePrivilege	2228	TieringEngineService.exe
Token: SeManageVolumePrivilege	2228	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3360	AgentService.exe
Token: SeBackupPrivilege	2624	vssvc.exe
Token: SeRestorePrivilege	2624	vssvc.exe
Token: SeAuditPrivilege	2624	vssvc.exe
Token: SeBackupPrivilege	4656	wbengine.exe
Token: SeRestorePrivilege	4656	wbengine.exe
Token: SeSecurityPrivilege	4656	wbengine.exe
Token: 33	1304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1304	SearchIndexer.exe
Token: SeDebugPrivilege	3704	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2388	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 4180	1304	SearchIndexer.exe	104
PID 1304 wrote to memory of 3980	1304	SearchIndexer.exe	105
PID 1304 wrote to memory of 228	1304	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_8861e09fc30a4378c6db9dc28ab22c9f_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:928

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5076

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3752

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3116

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:672

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1068

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4180
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2652 2808 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3980
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2820 2816 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8d283594092f2b5eb27dca4917641d05a23d84b3cc533ff39fb28f24b0ce3883
MD5 c26c06addecd10282671b788d61c783d
SHA1 6fbe9965ac469ac609b90d2eadb53abed0bcc784
SHA512 371bd4a55ba2e397dfcea6f193086241dec5ba2aa3a2705a52208be54cf26cc1a96b85920da088ad8fa3b6a02ed61ac1b16a30772af7785790a33522c27d178f
SSDEEP 49152:Gb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnlfJ4klKXnE:43q6mjByfJ4k
TLSH
T14CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 4f58bd4a9932a5d704bb76162cffff4f7643d907e19baf3e1401d221afa09ccf
MD5 51650ee6310275228f3470899163d6ba
SHA1 b8f52446d93e0dd00b26dc1edea3734aa8411723
SHA512 59f96f4282194ae197e91804b9d0ede24414ca179716972dd06a4b143a27ae6236437002393cafc210f09b7f8991a889eeb161d6fd4cb560c80e054dce1321ff
SSDEEP 12288:H1XLsswWkxy2lRq2czAGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:VXYfDtczAGfJ4yL/tNCJPXUQrPR
TLSH
T15B05F12973D008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fb319ad0258d87975b2012e6ce8172798979dfbdde5847782d6bfedb18594419
MD5 6dc387b21202fe1858e26c5d117a1518
SHA1 2ff53053a699b4c06d9a680687ebc97a64f85aff
SHA512 2d678302ec153aca43e92b0a15d60e6bf4d746829d40459f67331cb75cd727c30a9e362dab43db22a37962cf836d92f0e99ec2ea9ad4a8353f6b6bd36fb2e574
SSDEEP 24576:c0Le5ji0hmxhrMdfJ4yL/tNCJPXUQrP/:cPji0AzAfJ4klKXnH
TLSH
T1AF35AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cd75c1dabfcbf06cd766d26cd080f1bfbb8a8965c3e259495fb4404450487f25
MD5 a4d06cbba3bd3ec44384f93e7900da05
SHA1 f8e2a5bbe6ce2dbc9a56ccd83212b922d0ef1c66
SHA512 c415f409b3b100360758dba59fa50fd2faca23de77a4a57f52753bf1dd06a1b86dcedfbe5529e7aa36da78f7069fa636ca4de035cc6f4184d655471fdccde329
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWj6q8wyurfJ4yL/tNCJPXUQrP4:D/ezSC6vUzPv+HjyEfJ4klKXnQ
TLSH
T147756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6086ff09589b9485d3cb9accd1c82d3c551e988e265b29d7a2bf965881150ac5
MD5 b811a33c3a19fc51290116818b0bec6c
SHA1 e271c818b8c93f69bf8c29880255d840c0f86041
SHA512 223daa97777ad8ef1e228538138d46be3db5e98f492e06978cb5ef9b7623e0c873af91c88dd55ba12b49ac1ee1714fe98a47d837df81471633bd1f1db509e415
SSDEEP 24576:wVbqPb88hv/l+BifJ4yL/tNCJPXUQrPY:wVO88hXl+gfJ4klKXnA
TLSH
T102559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ccfa25826c449e5bfc58cf8de19f02e95b5b44da8d7694024301c5dbc3ee9960
MD5 3d81ed1b651b3156a0b25821a3e03d33
SHA1 d4e90521348af54a90474954abea6137dea477aa
SHA512 9f6cec9b561786240c84f70f7e512dbbb72abbfb17ccc5da08bf3c1ec897c59d9c8ba09962f3eb9b5f33cb1be2f25fff6e86e912c3708bb7d57afbf340794df0
SSDEEP 12288:mG5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:mG5fJ4yL/tNCJPXUQrPe
TLSH
T102C423E751809486DF6687F82A88F001C704BEC5562FA2F6DE82B8C57FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 dbc963bd34402f8ee2bfd1162d3c4c61e68fb29519666e7dfda4ad2bdd628b32
MD5 bba51b7673f1af9c26506b24d991b68c
SHA1 0bd192213222a59d39a3c6905d45119ea53b5138
SHA512 a24e89401d80a89f3359e64c8b76739f1123004e8458ec8707a8bffff1590fb6ecdb59304cf30925ab6ea5851fc435b3bb002ae1a1d4938cb591ec2de8b8d7f7
SSDEEP 12288:beBNUbTVO86U6fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:bJIU6fJ4yL/tNCJPXUQrP6
TLSH
T1B005C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275E51D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0301d61def30ae01c3fbc5759616c5f0d763c5072be8b8a31c2322173676af07
MD5 df693af8b7e096270e643b1d2adc7ae4
SHA1 1f459706aa0970cd5ac962a547f4e94a6c821585
SHA512 857bb4a808f276fa1ef6818d3eb5f0fc69ceafc72bda85ee90596da2c41a6aa81b6ec434b537d5585ec8b62e473cced17eab5f2dc8270949d18b39b9c6936649
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THr:PQvGAdlCEL8c/WRNw5CbfJ4k
TLSH
T1CD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 ce5945bf2e0745e26e654f23405180b921ead5433fbd28f512a2a4e419c23f43
MD5 eb8cb727a12e96f1ff8e57a5ea0b82cd
SHA1 1e57d50ee52a274ee273d6f2ee972754c51afcaa
SHA512 5c1bd3d74946d9a22d2f84cb7205df61cbd709605aa86a13eb4c6e7f5248e7b8c616aec0b91d83fa637100c71a9c94099fb404afa564354502ab323ac8c5388f
SSDEEP 12288:2AwSfxL/2Dc3mDLLmt0LDQewsAjwfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWS:LfewsAjwfJ4yL/tNCJPXUQrP4
TLSH
T19715E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5f1c6618f2583a8f82b1b12838bf2f5fc58d1b6c8973f0b4c794a20ee1ce97e7
MD5 5706bee78c9f8df621cf943206eed2d0
SHA1 6d2030ad3bb7b153032ec753b941ff03d283473b
SHA512 773f24f0463cb8445851e7c92f22b56a9f0bd6079f738122bebd26e997459b3ab3f1a73404adcdbacbb324f610e3695dfdec72cb42d8a262702fc231bfae740a
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4fJ4:JUEtQevvqc2W1cpV20I324
TLSH
T140474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ebf80d26a37e98412035d451d1a6e9debcb9496d96918edf2587a2b51628c02b
MD5 46a6a91283d611643b33f4a1cd5f8d0b
SHA1 2809244b47b544501fce9e18fe080d128477f6bf
SHA512 3e201ab542fbeec1da6b690cb71f01fd2bd734920b3d60a480eb8d759817ab342095504994c2112bd845cecc4d1ed62a3760d76e4bfd1443928add8bdb318dbb
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/zQfJ4klKXn3:uoqtVjnmvfJ4k
TLSH
T1D2D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a5e483bb8eed1f3fe5611de92cd2d92716f209a0042dec7bc2253843cd768f4b
MD5 28d2886a76f874b0e1050035781b2d46
SHA1 a322423318cdc00f4044968901c8a6272a955bc5
SHA512 803e12cc376ed9cf726a982b7043fe263685192f0bc76fc233016d44baab2cee99e51fab9f529c67dd460418a656687ee0160d9ff29fa842d16f4cff4496a769
SSDEEP 24576:JAhGL6IFoiwtA5l7S53PfJ4yL/tNCJPXUQrPg:JAM5Foiq5ffJ4klKXno
TLSH
T1CA359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e76c4525271ffd295d4aa938afa7e7180accbb0828748d488d20b705da8965cd
MD5 f9fb0347417c84562e653c102dd64082
SHA1 394eeb4a0ec35b88faf241aa94e6cd0b942a698c
SHA512 563f103417f534b1a3d8ef3a9039732c4eddcff8130c355cbf29eeef87dea7461c5a2f0a6fa0f0cb3431da13292d4c3e023e2bb6d2705ebd64c1e06065b73c57
SSDEEP 12288:imw5HEjsChNEBFgl0WDm+CLfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTu:7wuROWkfJ4yL/tNCJPXUQrPC
TLSH
T1E805F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 420066b1a8d6962d9782af62f2444f313cea286832493841fa274e5e4b64650a
MD5 d0566f97e1693c2c8a6cfc4fe1fc4dda
SHA1 80080117921b829535f1e326afa700daaceabe08
SHA512 b91c20b10f5eeda4500e1b533ecfa5b410a1c2e38ea2b8f138db98436b2a212ae51d8fea0d55b1679849092f63e92278da089cdd8b8956c2f433b3ab722f9923
SSDEEP 12288:FyZ1IygfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S0:cZuVfJ4yL/tNCJPXUQrPz
TLSH
T1F4E4129B32D460F9DAA782BC89D4D101D3217CD2273A83CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7c043e5ef4ca87a6ec17a41f96f6f514b66270bff874ff6a300dbcb3641d83ff
MD5 b7c50e2b01d84b362225612b226c78d8
SHA1 9f2bee5f1f65101740f87094966e2863174ae100
SHA512 dd97cc85de2072d77895b568b8d9385b371a38deae257209e6477ec1730be6597ac293fdf7875874c0f496e2057627e694e6c25d25ad2f7f8d7af1dafd2357f1
SSDEEP 49152:6j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uc:ZQRQyi36YOcPDLvw2gAf+PN3efJ4k
TLSH
T1BD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c9d9ff555fba1844328c2085945891d97b84302c3a2c9848ff8d6d78cccf6acf
MD5 f49e7039584bae51b7edecef94267746
SHA1 0126d39c43e18b2e3910e9c0c84cfa99f1be7d70
SHA512 9b7d0be83454b3205a7898eafeb7df180da134a7d832c10fe02872d1dc4b543dcc65ff09bad4155069af3d2f252ef8cbb26710c0932f64976b2083f4b124a8c2
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uv:XQRQyi36YOcPDLvw2gAf+PN3efJ4k
TLSH
T15B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a280d2d8ab774c251722637fdb1c00243245cf317b7805611639edcbde7f5c43
MD5 3aedd14aca7af607bd0f94269df18fce
SHA1 7ca1f2be64418bede2446aad55b59bafc15869c6
SHA512 33b283fd0efdd33b9643ed788dde8c57aa1f25314e553825d991065a5e5ea6055d1322ece1ede841d045313f993cca0b15b6f52fb0885cc55f4fa36ac9e0c163
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0lfJ4yL/tNCJPXU5:D68Qg55nhkeWu7PNU3/AfJ4klKXnO
TLSH
T1F3B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 021bc56177a4eba1e0219069fe6c9aa1cd9afda4b5f7eb6ae216c97f9c1da2f4
MD5 870683236851c5310e171de764cbd0cb
SHA1 d3a0451a9349b7857da32698c177932e8d42b6ab
SHA512 843f7fd2cb2d279c7f499b58284ba28f1c8e75017b1432deb2b61c45ede0a2ed018757390bddbf2d33df28f7a8ae3082032a3084a4f57741a105d89bd09720cb
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99K:Wy5112gYy5azzVvU69nLKnhZ5fJ4k
TLSH
T1FD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e10db3610e6fd0fbe4deec27fe305bafe7ec96e1f3502d3a416d9ba739d3619b
MD5 0d55a13f888f02ccca043997ba593039
SHA1 826d4efc276113939e8f493e94b5684bd7116318
SHA512 fe591092febf6a00421445ee169c1bffb67b012690c23c79f65b903dd7bb756a09a14a83bfe1e13e94f5584a5132a6d979c6b67e09ed27b8994674c7c3354e6c
SSDEEP 49152:NB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glWfJ4klKXnS:Tu6JmIxd2dWfJ4k
TLSH
T18DD59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f45383d3fcd132dc087627dfebbc881895b0bcd832783b2fe869882a04b2a9bf
MD5 c56cacff4045a8a9f3346d5c4e610aec
SHA1 5021bafa17eedaeeb0993b30e25ab02abbc6f246
SHA512 452c28363016c023f653fb7297939c0ce9f5b108c9ab86a9f9f8d43f02f0d41a72877a33c2667dd7a23ed0c35c6609439eae6c09903fbe381b6a373e50e7602b
SSDEEP 49152:t1hpsNoJpF1A67U44CwH7R4xafJ4klKXn0:tmifPqRvfJ4k
TLSH
T1E0B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40cea40ded7fe5d43453f1d2f924afb5ee994cb6d22e04ae278cf37b870114fd
MD5 e9e1aecc89529f27ef557eb487f7a98d
SHA1 a7d277c32619fafd90f1c33908a7c47f124bb216
SHA512 44852d5d3c0f47c1b488ac227489b86eee9ae65ee66605f056608274a5024d3b92028bfb0439143eaa0ddd6d249112b8b44f1ae3a573b7489fe19b2efffd588d
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqVfJ4klKXn1:N5dKqi61VfJ4k
TLSH
T17EC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0d94fca72af3ecdeac93982e523a0ef7ac351ca90846c49bb5f7beed0d939111
MD5 8b98c8ce94690fb6cae1a6480cce5ea0
SHA1 e740dd2c5622c0692b51301e1603eb1b8ea71c85
SHA512 e9bbf57d9ce17ec9611cdd5624c3a2b8c5dbe7a72f13efbf79acf9459dabaa0c6cc03c318beb5768614fbdc691b80f524360234b1fcb0a9269bbc0d209a1065b
SSDEEP 49152:HhtSn8EApI0figjgiDn0AP5wGfJ4klKXnp:WX2iWphjfJ4k
TLSH
T10C95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 1f9047ee59e65d273833cbcda9d9f5373c5cf8a9fb3739f731cba3deb6e7a7dd
MD5 d7c2afe5bf8d72a98584de155b9a5288
SHA1 17bdd767651ad462a317fa733fafd381179fc345
SHA512 2d1bd9dd33986d445352d50fcbdd9707cbbc1c39c18009a790ae3f76f778dc8bcd7523c6178ab020568896c5b3e50cdfced275e34461292aec39646ffe501375
SSDEEP 12288:+xfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:+xfJ4yL/tNCJPXUQrP3
TLSH
T1DAC423AB60D5948ADE5587F81688F001C3087EC6672F62F7EF42B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 30b8df685826a966ed5f1b00a5097f2b32c97400bab7ef13c5d39d085e12ecf5
MD5 7a1e8fe0aefab8be638579a3b7dc075a
SHA1 05545ced8b025c739aeb56439a028ec4bdcdf561
SHA512 65049f4bab60e7bd08794a32ae9803dd69756f7ebe0a54177bd7dbab0f2c3d15e84dfb2769933c16442e826db167b84415b6fd7370b20db00306ad45e7f500fb
SSDEEP 12288:XMfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:XMfJ4yL/tNCJPXUQrP3
TLSH
T119C423AB60D59486DE1587F81748E001C7047EC6672F62F7EF82B8827FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 2cbf3f8c1f3ed578c06e94e597a4413b08b8a37cc8ffc50ffa096d0592ce3fad
MD5 cc24db2b32f8aa22333e1d5c913c854d
SHA1 295a42089b873ebdb81145526231d71364193d13
SHA512 a1c8506ad7f638ac3d809a85b605c6068ed25f626db1a0fe1a2d15a8d48c8397b416c2722a4b57aa42e7534c8ad131e6a8948b5f837d7ace43951dee8df9c450
SSDEEP 12288:JyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SD:JyfJ4yL/tNCJPXUQrP4
TLSH
T138C423AB60D5948ADE5587F81648E001C3047EC6672F62F7EE82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f27532cb241d346e8195e3d42c0c0aafe4f41fd4870693e5a61a7b0efa54ff06
MD5 3303a7033886a147cd6e34ebc4d467fd
SHA1 f245d2d7a41a98f015905a80639598792566a472
SHA512 7254277e00ca2d1aad206b58c2080cd37eda16458794efffbd092e87a2189007a3dd35d6d23d09ee4f61c81ab73fc7c16dd3ca7f8a44865e069ac61d112705b3
SSDEEP 12288:4VvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:ifJ4yL/tNCJPXUQrPN
TLSH
T1F8D42397219480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 13256bca624242fe97758c155a7800e229526fbf726ae48cf9ccf14e4f43ee31
MD5 9c5a379e6ce4d80953c9390830903414
SHA1 e05d9ef38e063eb3faa74b58f08d350bf843901b
SHA512 5c2a146542cf1f3c916ceb5429805c3927ef63462e1a4aa7250bf781173d140f924a6b09c34680c18c070cc4ed73916e7c8a3be90568f8fef8b02b2324455d27
SSDEEP 12288:U3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:U3fJ4yL/tNCJPXUQrPO
TLSH
T119C423AB60D5948ADE1587F81688E001C7047EC6672F62F7EF83B4817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 4192af1d019f2a814e2d8f0a680935f2942489a6534d697fec924c1f51370633
MD5 4a8af0822580e437208c621b065b0579
SHA1 d305a6400800feb0873bc100de1cf7893247073d
SHA512 6ddc712d67743cc39ad4f6151b095831d58f11cdc059f7250453a7689fa2ae651884ef4a336406b2e7ada68ca3ad047fcc5016ba3f49304bc91dc07f476b1814
SSDEEP 12288:FofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:FofJ4yL/tNCJPXUQrPO
TLSH
T188C423AB60D59486DE1587F81A88E001C7047EC6672F62F7EF82B4427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d45bcd5809f22199b3290f00bf61c151edf9d2884d3637d80ee1c95e41a2237c
MD5 838882c8fda51ad49e1545e726cfdc6b
SHA1 1e70d76b03ede9db5e97b17da69f65f59947b523
SHA512 cad60ba738b4746090453a51b7eb3d7cfea1fc510d7b7b5f4bda428ed6570114d7c9543ec4a7bb2eebcb32ee9f33ed046e5b244421b8c9a3acc9b4805af18fdc
SSDEEP 12288:r0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SJ:r0fJ4yL/tNCJPXUQrPm
TLSH
T13CC423AB60D59486DE1587F81748E001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1c5f33105d8a69a82f59e0c0839a45c10d978ce484cd375407ad3eb46c85eeac
MD5 6f544071e622f7bbc88600d630d0db1c
SHA1 0bc48fbed8e1ee02a4a5fbe80faf72234cf0ef23
SHA512 bc763dee9c1e144a7c866d57c08a75ca545555f75acb72f9cbffa234700883e996f367cd22abd286e4fcdbbf7474a6e1fd0de47b48546bf3d615db73e1842f11
SSDEEP 12288:niZwbDzzFEoS2cPvysfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:iZM3zFVSOsfJ4yL/tNCJPXUQrP1
TLSH
T17C0501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c807163140a336ccfd585f8c243655a4524f734b9c14bcf65b2897d42b118c18
MD5 47313794d8732b3448a67fbcc8abab4c
SHA1 b593628532b2da5e3fdfdd95ab3787fe1145e6a0
SHA512 d99d2acdd30649791083cf982acdde99ffe3a786221a03b77fb64f20a94179b1cac1e702c40fef763334c661cc2f2ed112eb68b4447c92d35f08f2d4d0ac0748
SSDEEP 12288:tFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:tFfJ4yL/tNCJPXUQrPj
TLSH
T119C423AB60D5948ADE1587F81748E001C7087EC6772F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 bcc16dc4bb35892e5b2b92202c9ee3353d1c7348cafb63d461630f74044db7bc
MD5 13dccf099b67a9fb9f000ece4c5da031
SHA1 5a4ab2cc4d087302ae96114e8bad65bf1a297a23
SHA512 c36a3de5ddfcb901cfd45384e4d54c5fb53ec52685fec10a559c2988d4ee7ad9c34b140591f0b5ad387a7c42731661ce5960fc96f55328ec55897023ed024c6f
SSDEEP 12288:5pfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sv:5pfJ4yL/tNCJPXUQrP8
TLSH
T18DC423AB60D59486DE1587F81788E001C7087EC6672F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6d25bd63b46b69e92d80aa1089ff5c5c04f8a365791d47f03da1931d60fdbfc3
MD5 6d9f034bb12f44015748afc717f993a9
SHA1 ed11dc3a4703dcd563086b348991d9edac6d2261
SHA512 6e0f82f9071d74bbc47a5f1c24448c6ae4786c460940833a4c61eff83fe2366beb633a727cb65d4bdd3d346fe51b41f007ded0b09f47f85023e5b834b204fb37
SSDEEP 12288:iyPz5L8gfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:/zygfJ4yL/tNCJPXUQrP2
TLSH
T18DF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6a52ecfde86eb63ace3b4716f4f06181f76b468b762769ea00da58d6be5ea8e1
MD5 9a6aabab71c537cc7cb730eed447f75f
SHA1 495abe61103b8b792680e512ccbb1e09c27f65d4
SHA512 e78849ccf5cc856ab657e00f62fbb5bb5ea939fe7766433f5b098512da3c0cfb56df0ab12505be3feccddc0a695cdc5ce1140fbc252cd08c6ff398bf1e1daf1d
SSDEEP 12288:tFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:tFfJ4yL/tNCJPXUQrPH
TLSH
T10FC423EB60D1948ADE5587F81748E001C7087EC6672F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 a19a1e085b40d394f4040918c8588f93e842efae74a1abddc6b2d0d9b0c98705
MD5 3075fd3004c779ac0df20e5e7f2ae465
SHA1 5186ace45d040eb72b2251fec245490022f72970
SHA512 621f68649a2aec345ad3e256185bee4b9bcbe65f19e548ce9d7da653196f3b161d1ac3ace3dbe848b604d9c822ef86c6bc1dcf18177a3b0cf177f9be8b3dbe56
SSDEEP 12288:WFfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:WFfJ4yL/tNCJPXUQrPH
TLSH
T19BC423EB60D19486DE5587F81B48E001C7087EC6672F62E7EE43B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 95f656853a47a3938736bf417fe5e83786a143390ace3038746ac5d29acb0de4
MD5 ab39985cb0b558dd5f61379843f3c535
SHA1 041e57ff52b95fd1b6e5f4a6b108510c1e32047c
SHA512 1a0ca5e3a08fe0d64cb12b388bda6feee96772ca86ef8ba8b5bdd5973926fa07fbd2eda2ec90f3cfff5516e4da14f73c66fe5cf0889c29146ea1b4dd656cb506
SSDEEP 12288:iyPz5L8gfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sq:/zygfJ4yL/tNCJPXUQrPt
TLSH
T1E7F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 549075d0a099768722385623ba3f7e12ac262b48a1fa046f4348027d3bcb4922
MD5 777b9bccac202b7bd3de5feea5db83e5
SHA1 e243c30055fa32afa1f81655d9ed7ce6a0ba0721
SHA512 6eb586a7d068a6b0251aac632bd916af583be63fd6cc0b058b019eb4bf268c525c756bf07e180cec08047bcaea54ef7f031a20e8683249c763c08aedf466bab3
SSDEEP 24576:LCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAufJ4yL/tNCJPXUQrP4:LCUAPTY+8Wg2lIL8lrIUJLWw3fJ4klKQ
TLSH
T16665AE1EA3DC0896D4BB81748A51CA06EB32782E1B22D6CF1160C37D6F67ED55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 69f18ef14b8e54da1dc70f4a1380070c3e81b56f1086c80a53306f30c80f8f27
MD5 5da43f882ccb1aa007eb798472484936
SHA1 b6475a256a6b7589fef998448549ed6cc03cb573
SHA512 1fa7d57c9edc63498e570790429704e057c703dee48eac8bc7447c5bb6a7de1adebbfaa4c1ff460b4cf0d4ec6a338f7b934a6d2defa221e453302e4e797672a9
SSDEEP 12288:EpsfVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:VVfJ4yL/tNCJPXUQrPM
TLSH
T1E5E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6905DE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 250B
SHA256 e2d422dcd2f19e0a2d63941f3db258ca526b25d0432764da8ba9501b00d40765
MD5 6683dbef1b7bda4f0fbe024558d7f7cd
SHA1 e777c9e19f3bee35bb2d3bf98aa645100e7998da
SHA512 7c420715e5ec720d5201e9747f6c6df9ae1015ab434565dd6270bb0d0c6176cf6f2cd23f5d9cb53142c14e895e54bfd89e230a27b8a4d5a699ff03774052ed9b
TLSH
T1AAD0951C2D8740787473C4446F7F078DCF4154174C204330304501C9167041D2AFD496
MD5 SHA1 SHA512 TLSH

Submit Download

DXError.log

Path C:\Windows\Logs\DXError.log
Size 1KB
SHA256 5d9dbaa33db18ab8a96d52063b6f0008c25fcfab0121c478a899dd39ba455cf6
MD5 047a55c88385fabed44b34a0f4dfe0af
SHA1 d93c410df53b59310b92a68dc345bcf9c773e09f
SHA512 6b0220bf75e9c260f081ed288503008a81401d39c09e64e5179a3383b1d1c8638cdc7e925591e0c395cfed79d4944057cf96585fc4348f17eaf456cc4ed81348
TLSH
T1A41136081E97A06971E7C054BF3B07ADDF91559B5D619B30308542CD5AB109D3ACE8BA
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 275B
SHA256 f36e3472f8a4beda06a52c7bab5abb43f40d4fcace598129675e194a3d61c35e
MD5 9312124deffa638453cb3fb31d3f22bf
SHA1 5917a75e055f768816604ea64eeb4cb5b4f928b5
SHA512 c4197b1a5f9cdda1dfc383d9b2cdcee9472e597f5b28e6e35be11490c0ec4de3a6540aaca061ac6932fb04ee38fdc17332d270e2de3dc1a63ff23f66ab0e52c2
TLSH
T150D017863EABC55036F048984E3E0E4BA905E87B03315E302AB4A484F064E4CBBEF55A
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 1KB
SHA256 c295aef17dea068201c44d2a53363374d77d220cbad725a7f11b7f9f147f7bad
MD5 b23048196eede6e7d50a7d0bd85e6211
SHA1 b41163162700005e1fe74b8d51834d7127219456
SHA512 b2cd42dcf260886e8edbcdc793f824903cba65f78f4fb466a098820e0c23df8577f8e28c2879556e3e126f1ea348601fb8a091903bbc6225d733997b76df6652
TLSH
T19021A1833EABD45175F049445E3E0E2E9A55E9BB07359F302DF081C8A054A8CBBAF579
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d620b79970c2f36e3de5e56ee0f2c7fa39d942a5b3de7c81f66886ed162af9ec
MD5 6da3b1f3a0c00c69bb495a54020af335
SHA1 a2003a7db2b03a4589a0e6a4fb038528d6e6dfc7
SHA512 02cba0c2e0e819723ab0ad495b89030248853d84a62b09b0687fd18edfc2556a572c7f36a2a4bf2767e87ff91699e9714e20ca714029535bfbfada6884625a01
SSDEEP 12288:rSfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:rSfJ4yL/tNCJPXUQrPG
TLSH
T15AD423A751C89446DD7A87F8164CE000D308BED56B2B92E7EE42B4853FFC9961DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 edc6c0d7024d9dd7efdc4da698a2dc9c051a6c95f80c8c1d3e1620e8eac28081
MD5 4f653f392c67d573e2986fe3a1be4b6d
SHA1 0cd2f5c196d5d05181ba6e12c3bf4725d7bcda58
SHA512 588a345f519938df2b38578b48a0e2a560239c4455133a3a4148edbd3779af99ebd8d8affacafdd2c9c53958da6a045be7476bf781b76753227e866092a71bf8
SSDEEP 24576:g8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCQfJ4yL/tNCJPXUQrPi:BRZwQCyiHiQEaaPnM9fJ4klKXna
TLSH
T19785B01E62DC46A5E0BAD2B8CDA74407E6B27816573193CF0191C27D2F27EF45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 5ef64dfb6a8d92d95ef44df7c172475a0d62bf52ef38790dea14a8b4720c2042
MD5 678afff72496c6cb22d21bfbaad0fd92
SHA1 aac92ff30544a97fe22d76b7f01e76e5639c1dba
SHA512 bac58f889e6b986368bdce5d1c187c1e8a4384c91576e1963c7a8e0c8a02593a37f8cfb2b6b0a85ed635bdd121a7a236b82d921556f0efe8bd6c9ccb93bd50a1
SSDEEP 12288:ZbxA1U7KCfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:ZbxA1UGCfJ4yL/tNCJPXUQrPZ
TLSH
T1A7E4126F21DC24E5E976927C4984C001C331BC962726A3EF65C1D17A2F7BEE91C39B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 db5a592725f7179bbaeee04bb69c5f91bf3e41af937ca13474470daf2bf67003
MD5 6175143919dc6590a52df0fc2e4e328c
SHA1 3233ac6ea84b92890ae370c8ca8c126120b4132c
SHA512 20c7735346ce39c557a28127fb76407da6b9f0a197a0b0e180f6675e60d1e05b40d893490462c1091470e07eebb6fec51bf71abcc11cbdb19d90a078ef199545
SSDEEP 24576:SjsmP0yHaqrVqHra44KDzMsrnffJ4yL/tNCJPXUQrPo:SjRP0yHfVqzlAsrnffJ4klKXnw
TLSH
T14F45BF2EF2B910F9D8AAC176454143B5EB71782D1F219AC70170C634AF0AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 e82d0ab4bc343b85c98388231ba1e1914840ceff2bf8bb73f68b3a060efdf50f
MD5 cdc12612eb70234c9e754c6cbb2b797e
SHA1 f0a5e0bd37715ea537d214cce95565ab4eb9cacf
SHA512 328b6ab3c508749b1432066d4a7894cb7c400ea939a6444490c5d5da25f098aa58b08a6a9d1c86fac69ee9ea5790b95dbaebd6cf51c51e67dd8c1177ce6f886e
SSDEEP 12288:RIfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:RIfJ4yL/tNCJPXUQrPY
TLSH
T1ACD423EB60859486DE6587F81648E001D3047EC5272F63E7AD82B4827FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1fdd2ce9f1f8db1a0f486e0d3e10c8a29c82be01d27d4ca7a9310083e6db4763
MD5 8a98d5ef5c3146b950fdc4ed1d1aa740
SHA1 7f3d15dc4e3e977efed07c6f1fe76dcf1e271fb8
SHA512 8d0c63dbc2597e9d6f96ad5df6926f9838d7d313e7d16ec3205903e53fa8e4d0ecba9955244c992d9e92914c9e283635e70c01b3f710e00ed062d5aec323fd91
SSDEEP 12288:WObIA4LWO+vAYFTGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:/ALBUTGfJ4yL/tNCJPXUQrPY
TLSH
T12C250155F29400F9ED6BC27C89A6D512D372B89D0324E3EF07A88A552F637E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 239c9587da417f64550fe2225115e3c117a8a07420a5b73d145a6cf364fd4315
MD5 40262884c8ed6bd41106caad8220b736
SHA1 3f3ea0cfbc5a6d9a39353e285b3b52048828138f
SHA512 7d30cbb6fc1b60e9c976c11800a1c3b7bcf1bf4bd4d33abb6e294817c5767d9c1dc5b44f8bdfaca9c491e7d5133ebbab86dc25ed44943d97a35f88c23061b491
SSDEEP 12288:E70VmzIYNvUyBpBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:xfYNHTfJ4yL/tNCJPXUQrPj
TLSH
T10005F12F62AC08E5D93B927D8AC2C105F3727896171692DF05A0C2BA1F67EE97C3D741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 598c4cc83e8e3ce4d4b3e949e5b804dcce7f9277fdcc7ab5952fe8b2305d7a7c
MD5 436a3f9c293ff1bda8fe77d6416a3cc5
SHA1 8609c8a8a2e6c861fcfb8a5fc458e12e2807bc34
SHA512 2ea2f6b9b9c9a9b881a7ffeecf1780e2c7c94b1a0c6965489564ed1399c0a53604aafc072122d4e2143d6f04177f84156bbefd293fb421a7c64dd7940aacf0ab
SSDEEP 24576:ynXoJjNYH84VVSNAApoEOW66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKG:ynXoJJYH84VVS6AmETJas+cHBjSSKHP2
TLSH
T1AA65BFAEA2BC04D8D5BBD17CC5C29506F5B178621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ac58217fe209d60d799c31bf3c5eaf349271970e2ab6eed4324ca13b76a66d05
MD5 587365a91f9db7bae15f10b46e006174
SHA1 24883c2ee3333f904ed9ce77800c406b8ce7b1d4
SHA512 c2c4988e44b29a0de31b4759b217fd4fbee396adf631353b20d27125b5436b3aa48a847c5285dd00cf8028eb7530e048dad90ab000f8f3923bbc418027d86d8b
SSDEEP 24576:Dv7Xbxd9Tuycf8M/TYlSuxwr2PCZfJ4yL/tNCJPXUQrPV:DDLL9TuJ0M/TYW2PofJ4klKXn9
TLSH
T1BB858D5EA3EC42D8E47BD6BD85B69046FAB2B895173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 eca9c04d88ba932824cec63061eec59af8299e12daef762fab854d000d57c8de
MD5 e7b85a3f954dcd38d47bde6e6c1aefd2
SHA1 a1fb46d7e7fc8472cd2a4506d35a9ed61122bfd0
SHA512 5ffacf9da82c74d3a013558791cca5dfa719b6bdc87f7de1bc9d569f72bb300ec7a2b4dba9694b26cfafa3ad05fc4ebdab5a86f976295e59916f348b2e89ecde
SSDEEP 24576:AegJgpwJOmPOHWAKZ8ZguIGyPsxr5Vin10wGfJ4yL/tNCJPXUQrPw:AngOJOmPOHkGfJ4klKXno
TLSH
T16B55CF3FA7BC15D5E03EC17D8A968806F6B1786603265ACF0560827E5F1BEE42E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 79e955a95a028317b426de47537d008f0e867dfeb6236183fe19986a5de248cf
MD5 36f4bf5a661ca0860da92b966acdb377
SHA1 bd53b744693c4c42734682c0f28111b2d6e2dfa5
SHA512 38538162282ef7df484a463813c63f701f6d1cb17e0f298b4e024629e803426eaf703694fb448f60b9a135b33e227564b4a2d6809ceca61a666c19d48897a5fd
SSDEEP 24576:nLJnJiTk3R3waE4JrOofJ4yL/tNCJPXUQrP3:nLJnJK8R304lvfJ4klKXnf
TLSH
T1B915E03DD2E810E8D4B7C2B482596656FF31386C2B2669CB59B4D4313F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 943137f7e5c4d30225b8a06458d3e1b37bc2fcaad696c008a1aec6de241055d4
MD5 41d80e2e8ec90313e90896bb9b891963
SHA1 cc24ade8520c6b1784eec392e9f3e20c69dc7426
SHA512 a7b312cdde8175503421f0a8a23a4e276a4717288fd700064f645de2c51bc2667ba8fc9ef1c51aad1e00ec3326ffe2097a8e4684977476eaa5bfd8700be26bfc
SSDEEP 49152:19GqCzDScAZmlvTcFg8Ph60fJ4klKXnz:JzfJ4k
TLSH
T188955D05F7EB5298E8B3CAF1C96694159B327C409B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 1d43ad3818b3d8a5802e9c591998c97a0f82f4c65f208691f23193a7a6aacae3
MD5 10542f0b493c3194ab33a6920d1cdb72
SHA1 427dd4d3e6f68be687a1d6b551ebfc25396f8cb6
SHA512 a0f8e8e37e65de1327e0e9c67800c7e17c2edeae431e970648fa5bfa30e304983e2e49860f334a4a8516f9d7aebb095ac8fdd1bbc384e7114450cb99ef6f0ccf
SSDEEP 12288:tlYJeXm5nkEUuE2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:tlYJeXm5jUuE2fJ4yL/tNCJPXUQrP8
TLSH
T114E4129E319C70E5D52A82BC5584C100D331F8E5271663FF96D0D1BA5FABAE62E3CB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 6392f6fe29279beb887ea7cb38d77c3db298060b5f797e707c7bf3685bb2f713
MD5 8269df457e3abc1251ee9fdfe816310b
SHA1 58de1f289cafde6818cd41455650e3acbddaa86a
SHA512 d51b84a9b5e89fbfd0f1a2692ccfe35f4b1551062ae84bf799dfe796e263e922db85915ec9474a69fc233881ff7cf126db66ea8d58242702c741a8c3907878cb
SSDEEP 12288:Fwu6ky/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sw:FVty/fJ4yL/tNCJPXUQrPj
TLSH
T114F4235622D4A098EE7547B89A91C040CB34BCA05F2693EF99C1F53F3FBABD56834712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 78e62a0702517969ff691845c5e7c2283f12685435f3ca1fc2c2e781bdd0f8c2
MD5 3e75406235a3f2c63fdf5b9c941c050b
SHA1 4502ad7aa5d0b0a90993749565b9ef20708a499e
SHA512 885e1a65d1e721246f2cef4ee9016535268029683d793cd201ef95f7c56d9800c3da4862d77f4cb32a52e7b9f484cb7781df63a03eb2e896cf1ab4adc2e48bc2
SSDEEP 12288:WPGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:SGfJ4yL/tNCJPXUQrP1
TLSH
T1FBD423AF2194A089DD2587F81648E000C3147ED5272B62FB9DC2F4B1BFFD55615BC792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 185ef50ecfa02caa0617ef7f55310f2c611d9f03adb66d36bce06e73bcb3c867
MD5 f23ee7d284a9d2c4e3f3ddac37bea676
SHA1 0e757b5114bd3edb4c56f66bce5b45b94e87d9a4
SHA512 f78fdcd5b1efc32356a4b1e718af4e62fda47269f95863b4fa1762ca66285f8fe32efa19ae3bbb0ccdb0842fc569071a4143e2e126995e3610f99e435e35b8c7
SSDEEP 24576:EC+TyQIu93VAumZr7jm1fJ4yL/tNCJPXUQrPJ:E/TfIq+Y1fJ4klKXnR
TLSH
T1CC558D1DA7E91DCAE276C675C8A34493E633B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 59eecc24758949000fb11455466a56fbebb56d81e594f4899a08b92984c7ee68
MD5 91b27ce95e6f1c823d199396add87699
SHA1 7ffcb7d699a91a079a68a1d1f6b6f12a26dc8569
SHA512 fa2a941a40f12b3bd60721bdb97495d5fe976e899f1aa1983954d804be6b60ec246f58cd757bdf3f8b9873a13011842f1c837e62a3739e14bc675d04b6a40e5b
SSDEEP 12288:ucyrWOstaa3kcsKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sf:3LQikZKfJ4yL/tNCJPXUQrPo
TLSH
T167F4F10FB3AA00A5D5A7C27C88848102F77378B5571263EF4690C7791FAB5EA7D38B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e04d585ca56f466c3653b818815afad8254e147baa21e2ecb8d8db6a5e5f13b2
MD5 11361c1224eed4e580fe0b499840e03b
SHA1 7f5a9f552d3c26cbf4d5e74e308e67873463ae5b
SHA512 72bde3034c3e27a88135e994704fb195e7147c36548a65915401a460a46864a117508c8178aea7720ce3fa53e0e8b5e5e8c477309c71f81982cb8443268cf676
SSDEEP 49152:ppJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP/fJ4klKXng:6pC7b4+80GTk8fJ4k
TLSH
T1C4A57C3DE2F810ADD9AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c88ad93022206981ace96c9276a7e55351d0b1fa8f3f75323a1cabf76afda747
MD5 c0a45970e2f8fa400713d622f099f056
SHA1 1cffc53e03688bbaea9873067e18db59d61adfb3
SHA512 c4b1d0389a50ff036181f90e7d19f51e7d0bb9b3e784d1f29f95f600cc6bf8979744f68b238330df6fab1cbce0d9f62a8038963580919e22f6e42b5c9a01238c
SSDEEP 24576:fSAwJPE1IDAo+4Kt+l4413lUQXfJ4yL/tNCJPXUQrPH:fqPCIo4Kol4jQXfJ4klKXn/
TLSH
T14C55BF2AA7F946E4E17ACBB49663C101FB727823133163CF9290817E1F169E85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 d69c85359db878d54da9952e93dce7bd14134974475c11f2fd74d81c18c24c13
MD5 35bcf416dd8b0468866b112619f1aa27
SHA1 4def1183a80cc99fea2a63926d3a4cd79eb0cf14
SHA512 e8bf120125c622ea98f63cac20adab634ff5d45dd228d25edccbaed28826bf74425fd82ab5f38f6cadf8541b4f3bc29fe3360e88a29726b516eff07f47b9942e
SSDEEP 12288:pSsyLCFBoPLCRyE6NQ4tHfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:pyLXPLcT94tHfJ4yL/tNCJPXUQrPM
TLSH
T1EB25E13EE66C04E5E47AC27CD6928506F6723CAD033266CB199090792F6BFF4693DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 5b5648d578fe35ef13ba0599587b3448652b86d831ebb876211affa52646d3fd
MD5 bef0ac5bf5612e45ad51c58fc5e99262
SHA1 09b7f486a8e128b4e11387f599edf362f9192326
SHA512 dbbbbcc3e27cb309b2ce0c3f940b991299cf31b4e6de07d33f0bb0a54334c6e6657ed888c7976397f606bdd787a0beedb1567acd45b62cc3ea2152f95e42e17b
SSDEEP 12288:f9lyvj3IkxjbBzafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:fWv8qjpafJ4yL/tNCJPXUQrPR
TLSH
T146F4129F12D464D8E83983B89614D011C231BDF6132AA2FF75C0E8BA5FB9AC5953EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-227-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/672-169-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/684-122-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/684-112-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/684-126-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/684-123-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/684-118-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/928-11-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/928-140-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/928-1-0x0000000000850000-0x00000000008B7000-memory.dmp

Download

memory/928-437-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/928-0-0x0000000001000000-0x0000000001114000-memory.dmp

Download

memory/1180-197-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/1180-201-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1180-399-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1248-87-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1248-86-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1304-245-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/1304-277-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/1304-478-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1304-261-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/1304-230-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1304-239-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1304-236-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1856-127-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1856-209-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/1872-429-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1872-216-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2228-204-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2228-427-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2388-176-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2388-96-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2388-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2388-90-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2560-222-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2560-161-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/2560-156-0x0000000000820000-0x0000000000887000-memory.dmp

Download

memory/2560-166-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2624-432-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2624-219-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2644-145-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2644-151-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2644-164-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/2644-214-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3116-200-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3116-107-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/3116-109-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3116-101-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/3360-211-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3360-210-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3688-213-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3688-141-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3688-137-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3688-131-0x0000000000850000-0x00000000008B0000-memory.dmp

Download

memory/3704-81-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3704-82-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3704-73-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3980-501-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-512-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-520-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-521-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-519-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-513-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-516-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-517-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-518-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-515-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-514-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-506-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-507-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-508-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-509-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-479-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-480-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-483-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-482-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-481-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-484-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-485-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-494-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-493-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-492-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-491-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-489-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-488-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-490-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-487-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-486-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-497-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-498-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-499-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-510-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-502-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-500-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-503-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-504-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-505-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/3980-511-0x000001AB17330000-0x000001AB17340000-memory.dmp

Download

memory/4132-282-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4132-177-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/4300-185-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4300-187-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4300-179-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/4300-306-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4524-477-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4524-228-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4656-226-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4656-433-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5076-165-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5076-34-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/5116-173-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5116-238-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5116-476-0x0000000140000000-0x00000001401C1000-memory.dmp

Download