c6b3414286a1dd8eb8193b0727bda96c3c48fb1e3f4319fd0e8a93a28c8c9deb

Analysis

max time kernel
148s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
Size 1.3MB
Sample260511-zydeaaes8q
SHA256 c6b3414286a1dd8eb8193b0727bda96c3c48fb1e3f4319fd0e8a93a28c8c9deb
MD5 dd316b4cb521ff0ede342e79f86ca2cb
SHA1 26c0d8342bf9d5ecd03fe7165ec66097b518357a
SHA512 fe214b43790b886dae194dfd637f1a7fc671ec6f54f074eed292a2901e467965256192c4d40d66fdb52d58e8f414dfdcc535f2688e02597284c61e4ec0b6ebf4
SSDEEP 24576:2TdigwhlOBN6dTPBFkrqsyy4n8c6ZsnquyncNXgeeW:2TkgclOB0TjkGsyy+8cGsquDBqW
TLSH
T16E554911E7EB8239FDF36B7C697942610A7ABCA19F38D68E1744065D18F4A90C970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2388	alg.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
2688	fxssvc.exe
2144	elevation_service.exe
4304	elevation_service.exe
4756	maintenanceservice.exe
4936	msdtc.exe
1096	OSE.EXE
3972	PerceptionSimulationService.exe
3696	perfhost.exe
228	locator.exe
1592	SensorDataService.exe
5116	snmptrap.exe
1384	spectrum.exe
1356	ssh-agent.exe
2200	TieringEngineService.exe
4948	AgentService.exe
1032	vds.exe
1968	vssvc.exe
3196	wbengine.exe
4216	WmiApSrv.exe
1184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b03b70057932a944.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_163328\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DPINST.LOG	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e7e5e338ae1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b0b922c8ae1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021f1d0338ae1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094baa22c8ae1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5e322338ae1dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005d56de2c8ae1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018040e2d8ae1dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000153050338ae1dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e18022d8ae1dc01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe
4624	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1408	2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
Token: SeAuditPrivilege	2688	fxssvc.exe
Token: SeRestorePrivilege	2200	TieringEngineService.exe
Token: SeManageVolumePrivilege	2200	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4948	AgentService.exe
Token: SeBackupPrivilege	1968	vssvc.exe
Token: SeRestorePrivilege	1968	vssvc.exe
Token: SeAuditPrivilege	1968	vssvc.exe
Token: SeBackupPrivilege	3196	wbengine.exe
Token: SeRestorePrivilege	3196	wbengine.exe
Token: SeSecurityPrivilege	3196	wbengine.exe
Token: 33	1184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1184	SearchIndexer.exe
Token: SeDebugPrivilege	2388	alg.exe
Token: SeDebugPrivilege	2388	alg.exe
Token: SeDebugPrivilege	2388	alg.exe
Token: SeDebugPrivilege	4624	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4864	1184	SearchIndexer.exe	104
PID 1184 wrote to memory of 2444	1184	SearchIndexer.exe	105
PID 1184 wrote to memory of 1680	1184	SearchIndexer.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_dd316b4cb521ff0ede342e79f86ca2cb_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2436

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3696

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:228

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1592

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1384

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1356

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3196

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4864
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2800 2808 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2040 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 22d155e383d0979e608dfd6a3786451c486d5d006880b5261745db9d1f148a8a
MD5 77982603506d9037cae94c5182a1f400
SHA1 a9bf7b73dea3e3e5bb4081dd0304d4bfedd4e160
SHA512 71352124bcf4a032bfc4ea51a5187092260e42d040301ba9a17cc2d580915a8c8ea44aa689802283c49783802929d994fa35fbb747d3ac82cda68a4419686ff0
SSDEEP 49152:Fb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnosyy+8cGsquDBqW:b3q60jBRsNMGtuDBq
TLSH
T1D5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9ae7fc580e1e88b2b732e1c2b9f04ace372bcf886acec9681505e3ea2a5ec5d4
MD5 43f1cbd17320b327123102db27ec1726
SHA1 8ef0b92da43168350eba577ad9664f3e82b70e4e
SHA512 8b67e311d2b6030d13e5c8f36951c2fa4d837ad9593ad50fc3c644c23fab83c749bfd9b71a441e834639374fa09a4d16fd2bfd8f837df213d273fd52520e92fd
SSDEEP 24576:WXYfDtczAqqsyy4n8c6ZsnquyncNXgeeW:Vtcesyy+8cGsquDBqW
TLSH
T11E05016873D409F9ED67813CC8A28515EA337C5547A4E79B03F0AA261F336D86E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d1d1dfdda97080a4c6d3f68d81cf6be083d3bbafd359eff456a8d5d04b21ff8c
MD5 9c6c00506e2e0faf000f2560d0ff1071
SHA1 7dca413806d389db18b49923d7db479e57dc2e7f
SHA512 0a2af34d2c38ce8f63c4167dd7b05290705aa442925f6c34cf94153346069932e34868800eafe18c557f1e5244b7b7770c10ec3245d5a92d98417c04bcba2594
SSDEEP 24576:U0Le5ji0hmxNrMZqsyy4n8c6ZsnquyncNXgeeW:UPji0A7Hsyy+8cGsquDBqW
TLSH
T11635AE56F6748731D073C0B9C5D2A68EED7130865B308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d3a088a98a81f4e59822e2ea59c58238f873d748fc850e06cb860f718e0dd9c4
MD5 0531d7695e424144eaed4c36dffac524
SHA1 017f1a17faa1126e6ead4af785b4e43d7368e8d7
SHA512 44663cdec67976fafa4c46b245714b4764fa7fcb7fc79df3320643f6adf3ee6cb66d0c2ea4ff7d2b94317f1f6df1900db8f51657b0354e9910c097ca517509af
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWr6q8wyuDqsyy4n8c6ZsnquyncNXgeeW:k/ezSC6vUzPviHjyrsyy+8cGsquDBqW
TLSH
T131756C55F5788323D0B2D0BAC5D6AA9AFE3230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7a1153423eafebb253c8219bb9cf927664a0ed9c12f81d3655939abc42346ae0
MD5 09913376e9929634d0c2fb67cd0fd422
SHA1 ce79545c80caeba4c628cd8ba675f77b9ba7ecc6
SHA512 788b3f40db70eb20e7a09cd4ba179ab59882a33358ab0687b72ce5b5f73cffa379d4d1ec5dbde60691a96e9046e11bb484da37170401fe2518e7375d88177ec5
SSDEEP 24576:1VbqPb88hv/l+beqsyy4n8c6ZsnquyncNXgeeW:1VO88hXl+Nsyy+8cGsquDBqW
TLSH
T1DD559E66F5748331D073C0BAC5D29A9AEE3234425B31CACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a31436eb47808f205ad8dc60f7fb57f06984fa4ccca64b2cb4aa6e03144d4daa
MD5 ac093e5f2ce4f61a8af7b96a66e2b540
SHA1 90684ebe0edb3f2671eca396fd2bb9a45c1d5e7a
SHA512 10d45b65876d6dd2781f6561c294c4f37cc797225a3a5c07318fdf1d9bbb6b2ade1a3697f900c9668faab73118616df48abe2dff0f3b9999ec2516c7eaa4cde6
SSDEEP 12288:djtcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:djtqsyy4n8c6ZsnquyncNXgeeW
TLSH
T101C423C217480FC7F3BAA03C52D9069C68352C7C8BE9D61D48B33F6759749A5E5D360A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9ea0ef7baa3c4c3689fd1bd8406360d0ee40b34f618ee5214bc817d812597ab9
MD5 0de22c0995dda773dc535fae2ee043cb
SHA1 8a1b69f5015921c1e30de24e8ffdd519a68e25ff
SHA512 3177cf314f67f02dd27971ee79d508b161140193f94d2561928917c1679431aeb43b6f90acb91dad6a3e00442075ca9ea97eee0c41570da570146d97d6893aea
SSDEEP 12288:teBNUbTVO86UWcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:tJIUWqsyy4n8c6ZsnquyncNXgeeW
TLSH
T11B05CF7BAE28FCD2C27A9D7856918600E77278304F62A3CBD175830EDE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6aa443b9aecac48ff3e8d4ded58b04439804988fe3e5cec44ea2d1640e78d5bf
MD5 5f2aece6ad6360a513a46f191ecae62b
SHA1 29b573bef34ae10616506b40e376c948e91e621a
SHA512 e28968dca70ee2fbd1b9f74e2ee0567cdd4bcfff35879a82bc3ab9bd611526c8c5351e2d149761a81f6064b6b9d3539591dc4566aab14f4268b2514697d5a3b7
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH9:6QvGAdlCEL8c/RRNw5C+sNMGtuDBq
TLSH
T168266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 3921f57a2e59af6ec41a05e1ee7c68012287a93adfd88fc0a4801fe8ab21ad5b
MD5 5672c691a7e60c2201a74facdefa5252
SHA1 d24f12ace82ab837e5a6bf9a6eda442ee421a4c2
SHA512 c62f63f16cf4f784e029061eaf4d80eef03b5fd9c7629e028debc2b5f386c95a093afb42cc3f1b8b2e41197923c1a0c1615c945a29f435c519b1c1297ea1598a
SSDEEP 12288:pAwSfxL/2Dc3DDLLmt0LDQewsAjAcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVU:aSewsAjAqsyy4n8c6ZsnquyncNXgeeW
TLSH
T12515E031FA74D436D3BB0DB61B26C71A183C79204BA11AC3E3E85E9E59302D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a828dc8febd01ab246d4c838c316168a985fcdffdc97fc527c6e4698d47d7202
MD5 b4fc092e3044c366abbdc85f1b8ce523
SHA1 4ef1eab3799b27810461d0d773ed7e80d0832bde
SHA512 e0a1d0e17bd8d50d1fd1c5f394add60310a46e165c6a3533e2535560f6ce1f69b241e4192027fd7bc66c28afa574c8d5a9d303fd5f0b88acc49698a449a4504f
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH0oVq:5UEtQevvqc2W1cpV2RI320o
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c42a177d1434de41c03306f38d0cc78b8bc0a02f933bfce4da7452324b9f6af7
MD5 2fb7151c566b1abfb23421cb39f80a85
SHA1 6adf3f3144a8792cbef511bef04b1e81464e49c1
SHA512 14972c9964256fb3fea14a38cd2ad2a26edbc4ec150b3e0928687666e11df79d868dd6447ebd44e546359ff9e4663f1693ada5ceed7bd677654c9a581a981aee
SSDEEP 49152:1CbRquA/m2yL5zifFiV+XenmE3/z3syy+8cGsquDBqW:ioqHVjnmSsNMGtuDBq
TLSH
T127D58E0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4a1a3a9baa215976804141409375f07c76386d2614de8f5a971a2d91a3671e67
MD5 e0a7dc1d40cbbe604dd92c38954980e1
SHA1 3cc45e44f7aa21a76a1e2b38e12827b51ac28c2a
SHA512 78af06c0dfba73429e125a537d4f21c758596e7e697ed59b9f0e821a979a697a9f2cc602d1454ce82b0a14dd141b6aced3c21215892b8ec80ebbefeae27a816e
SSDEEP 24576:JAhGL2IFoiwtA5l7S53fqsyy4n8c6ZsnquyncNXgeeW:JAM1Foiq5isyy+8cGsquDBqW
TLSH
T186359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9f0c3d517ea88884d3c090cae952385c7c2e57e47324cb527dd7a9637834267a
MD5 8c8beba9abb727b52351cfaf7898796a
SHA1 b85ef626cb8126f15050568e797110d8c4a11d32
SHA512 a46489d53de2a6680bfb044b7fbdf1a9e413fd8c7ead2cd92e93d4cf920cca05e7176697c36db182143e68019eac9c4815178e0570cbc4f653fe12405351084b
SSDEEP 12288:Umw5HEjsChNSBFgl0WDm+CjcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1:RwuXOWsqsyy4n8c6ZsnquyncNXgeeW
TLSH
T14605F18633940CF9E9B7913886978136F7B2BC152B25D71F0760CA5B6F37261BD2AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 a27b08e67cbe473058ec0508e935838ebef2fb0f3202ad81b46218594b6c8750
MD5 807962e642346b5e0783f6df73fdd894
SHA1 35700d45b1dde11adabb1e574aec46ec93467ac6
SHA512 166007b815b64c0aa988b49fbb4d8b43fffd14109ace1a2d2184d602066e19719a6a40c7cf546f9d6224f1f7894172109d34eb77a281fc27c9d2c5efe4bb7925
SSDEEP 12288:8/Z1IywcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:QZuRqsyy4n8c6ZsnquyncNXgeeW
TLSH
T1ACE4128633C825FAF2B7913C89E50648E7323C66577583CF05612A6A2F33ED16E76702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 af496806efefa84fe8cd66770c67218610522413cbf548688a4dff65879f285f
MD5 e363d9384c12c64e1de58b7472799c81
SHA1 e3906a894f6fb05dcafd672438487b309294118c
SHA512 0c498626a2fbb136d05ad0b589896d222f43b4c600c51d283b1ca8060d87f01e14797d5300d072048644e44a64b99a5f3cddfd4d0bb0f6b1a5dc085e62833b22
SSDEEP 98304:sQRQyi36YOcPhLvw2gAf+PN3dsNMGtuDBq:zQyiKahX+PN2oVq
TLSH
T146667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a79b1a358eee9f1bc407cf9426a0c7a9b5e3059ea431f837d06df71ad5cc5bdb
MD5 c3ea5cd37e404794db5a8c51e43853bc
SHA1 0e8f16c61e7dec08af111245227a956d4008d013
SHA512 d46702779c5079c17e37c7725cc9a4e47de4334c859a5af287a23b8272d0cdfb8db87efa2688da1ada186a3aae27e24c5ba7103860f64959fb860efa95f56ed9
SSDEEP 98304:3QRQyi36YOcPhLvw2gAf+PN3dsNMGtuDBq:mQyiKahX+PN2oVq
TLSH
T19E667C43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 18e73feba10d116f0457395dd1e4a8eb8dde4ee125763ef1080bd7e5feb281f4
MD5 61d31446473dd84b0969a2360d9f3fdd
SHA1 38687e229816335918a06fe41c1612d7b02aa268
SHA512 9761334d108a6390f1aba1cacf91c95d7224b1f2b4cf77037735b2c43ca9a25d10648c95e4028ab64fe90b5165210144f72b65fe1e36b56aca1607ab3f96ddc9
SSDEEP 49152:l68Qg55nhceWu7PNU3/Hsyy+8cGsquDBqW:zthLRc/HsNMGtuDBq
TLSH
T119B55933B2F60099D44DE1769F4A873196E27C758FE0E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 764725252b939ed1bc627e46404e49a1e76d3b1db32e064cfde15c7de84de4ce
MD5 0a6f19716b5c08d6f10f9e8801394806
SHA1 f5e20df84316873054fa73fdeb67ca7006a64966
SHA512 88ac2e3ca1da6d726aa147140da6ac99339297b9da75ef764449417c79532ba746163f1c8a406998d96e0eacceeb299565738955035832f99e66fb138a3ceab5
SSDEEP 98304:Ty5112gYy5azzVva69nLKnhZssNMGtuDBq:uLIHjWhFoVq
TLSH
T1EE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 adfdf0cfa989ab90eb4ce3f744eebcfb9cfdb6bfa87491de4b33a8ac03f6ebe9
MD5 0787cdbc79665ae1d84e380f0fb2ee2b
SHA1 29d5e1985dd3eb3415c6d48e202e57ceeeb6997a
SHA512 b001dfc7d1dffaae0b58fcd04e67906125e7921f261cef17582439aa5f6c2d724f5af5c6ee28516d84d530dbc8f174ab4caf9d7153cdedc0ad6d9835095926fc
SSDEEP 49152:DB+taZ3usBWOBr4tEG20bqx0z+n217aau1gllsyy+8cGsquDBqW:1u6JmUxd2dlsNMGtuDBq
TLSH
T175D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9c0245f7a8bbc5b4de5934a4b471ec42512740cccc6a084babb9e29edbbc9771
MD5 ab981fc3119180537afff5b1dba6156f
SHA1 1145769cfcee37a081419d4c91e9e6a9897e78ca
SHA512 7b2ae770ae3abb67731dc829d87747dbcee69b1f766518fa4315b2299e9e3fbdd65cdb071b06bb4a4f6415edfb802dec7dc378b8077404e9fe61422c621cb4e3
SSDEEP 49152:21hpsNoJpF1A6BU44CwH7R4xJsyy+8cGsquDBqW:2mifPkRSsNMGtuDBq
TLSH
T158B5AE13F29901E8D06ED17887569232EA72BC450B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9849a0f1a0c4ae4eb9a3af90cf587ee297ad27dcf4d76e1d0db8b1c173d8089c
MD5 24608eb69364ebfa3101999a8cd1b2e8
SHA1 9c0f56930395694c45061eba2cf339acdd44ef3c
SHA512 78164982bcdee04b30bdaf5f8bcdf699779017396767253a462223ebbe304fbce411b2195ff443f682c6e5ceb0d0597f4063ea638b283a86afa5fd1e528e79cb
SSDEEP 49152:wSuZQIY0Be2KNRVtOnks6NMHq4syy+8cGsquDBqW:q5dKvi614sNMGtuDBq
TLSH
T1E2C5BF03F2E901E8E0BED67887669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 38f3816027048d6bb25f9a38696e1301f6b7f41f487bb1d13a2bb19dfa7a8341
MD5 75e8c5ffcf96399039c713d39d65d399
SHA1 3b15ca8571d58b12368c0fab733fb96e1cae1a4b
SHA512 c7e6ca25ca453822a907e34e82f05b698b9bd0e127bbdde48872f8332da16b3607594e7eaa3a7d817229edd477581805e6cede22fe0a27e7205890307e263164
SSDEEP 49152:FhtSn8EApI0figXgiDn0AP5w1syy+8cGsquDBqW:0X2iyph2sNMGtuDBq
TLSH
T11E95BE13F2D901E8D06ED178C7468632E962BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 2724e188c3ae433c995a09c82e4754ba408e8ccb12910efb8e796eab632f63df
MD5 1cda3313ffff8942c2c41bcf30664776
SHA1 169777f75712bdf655de94a8312e7c42a9202c28
SHA512 2e8de070571383aeade6a8bf9325fdbc1ef0282a34e9e0079205fc0df8c982358b8b475ae62fb6af491d9a879da51d9fbe8677bfd0862f18c196ace8cc1639ad
SSDEEP 12288:oFcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:oFqsyy4n8c6ZsnquyncNXgeeW
TLSH
T137C423C226490FCBF2B6E03C42D5069C68342C7DDBE9D21E58B33E276A75DA575C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fde230cac597f3fafe491f7250c0079fbbe674548b8ba64df3ebcea2c812c00f
MD5 ad5f79b2e7516bd6a13c1b7f986db547
SHA1 2b9caa4de6540f3355c576bf53542a364b20d801
SHA512 72d25c9ed92298850f98c75aa7e93844748c105ad058cfe800f31e3c29aefda6f8893bc38b34495a80388984ef3d1d620e4cbe8b263bfe0f46d14769dd1b820d
SSDEEP 12288:IUcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:IUqsyy4n8c6ZsnquyncNXgeeW
TLSH
T19AC423C226490FCBF276E03C5295029C68342C7DDBE9D21E5CB33E266A75DA5B5C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 654e53f1f918b19201c8f77fd72787ea34ab48637d5d7070cc5cc0288ba4ff2a
MD5 a62ce9d25b63fe324380b03e296d2a8d
SHA1 cf381019a437c4e4cf90ebba576bd70f3fde1128
SHA512 443a2825192fa025197d1e51ad99725037418d006b10ea11f9397eee528c9839e35f49d3a14b32100b3d320f8b22e3ca99091d8a74814b459b210e4c5e60702b
SSDEEP 12288:EucziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:Euqsyy4n8c6ZsnquyncNXgeeW
TLSH
T106C423C226490FCBF2B5E03C52D5029C68342C7DDBE9D21E5CB33E266A75DA5B5C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 4b5ff704890cb9a786d1edc51bfd04eec06d3e87029d685c8997dd59c8536e0f
MD5 13d9f63a76ae165923a2d6d201e63ab5
SHA1 75a0638f00b47554a1dec43b9c1cbc4ffd7fbf23
SHA512 0b3af1082b6b17887bc4c31caf0911156d5bfb3051a55cfaf2ffc5ac37a0644b05be4733ced7385df217176c601d31ed3a212d264cf2124549f76383232348e0
SSDEEP 12288:mV/cziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:4qsyy4n8c6ZsnquyncNXgeeW
TLSH
T143D423C223480BC7F1B6E13CC5A50258E5357CB9DBB5D36F49623E1A1E71AA4B9E2F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a389f4d09ab2ed81669feea68dcb7dc98e00fdf02298bcfc57f2bd3f255e227e
MD5 e9e37dc7df62a338a1e5948f4a0e27e0
SHA1 d0a55dc301a13bfb1c9e3dfd755c3fe2916cf3f6
SHA512 431ab753fdd34a9b891717bff0ed53cc5907e90222277c856cd0290674c74e9a43b8ccbf824fb2c44d30ef0185e68e319a191a9034dd69455236b44ef9e40946
SSDEEP 12288:TncziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:Tnqsyy4n8c6ZsnquyncNXgeeW
TLSH
T188C423C226490FCBF2B6E03C42D5029C68342C7DDBE9D21E5CB33E266A75DA575D3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f28c32a53c0815c49ecf398598f9ea1506e1c362d3042706d915a996373d6e88
MD5 89bfbd1dfde798506872bdee6f79fc05
SHA1 70395ceadd195908876d61e052c3ec2343457b63
SHA512 89cd25191574545704ad98660b59945396f1b5f6fb6573e00f53b34e66e8303153efc16b7c6faf2bca6e97186c95ec6d9e8839e301a766160c1f39b7ef2b4f95
SSDEEP 12288:O4cziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:O4qsyy4n8c6ZsnquyncNXgeeW
TLSH
T173C423C226490FCBF276E03C5295029C68342C7DDBE9D21E5CB33E266A75DB5B5C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0a1f7d14db4b3c2f164da800a6aeb4bb696078a421ab022e3fec414337b8c851
MD5 c733a6eab47ca10374af904d185b3db0
SHA1 bb448a63f44fecd7c92c4199a31b3de4e721ad11
SHA512 a7b177a67455a78dee7be63feaeba8688d150099339a03f0bba0ec6577c9ee96a3fcc34817a5b05e8db37526f7ab79be76d75514a2657bcec8a49991c7f66cde
SSDEEP 12288:r8cziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:r8qsyy4n8c6ZsnquyncNXgeeW
TLSH
T1A1C423C226490FCBF276E03C4295069C58342C7DDBE9D22E5CB33E266A75DB5B5C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 398b06a6f0a1a2ec5a836f7bb0ae44cd16dd2bdad70405d5ea34b1965191efba
MD5 243cdd040abb58db1af22b2fa4607196
SHA1 6ba8d825f5038187e3df3453588170e76b16aaea
SHA512 8a7be6991872f9b11f82e26e9d1da7c27d2d7db61c4fce6c2b3e8d69ca326c06324952cd12d0dd5ad2f4f3d482dd04603ec49c9b90d9f5f9458e60ca4ecd1f48
SSDEEP 24576:cZMMzFVSO0qsyy4n8c6ZsnquyncNXgeeW:cZMMzfvsyy+8cGsquDBqW
TLSH
T1A605019573800CF9ECA7813EC9558909D6B27C6A4BB0C61F07B43A275F337A11D6EB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d1fa82cfa7fddcbcc77bb5c740a6a96877739ba07a7a2ec8efb3c9c384c44056
MD5 949aab65cb3c50b563e3e86784c0739f
SHA1 7caec154ef822e9c7ae11ba3c62a0ed63d877df6
SHA512 6e0045bc5012d15a1877657a8267a4884cf62587f9f67fab4c623210d972b990c010b58b026bcbf4ae635830980b46766fc363645ee621fbd0d5fa3880486ad1
SSDEEP 12288:fBcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:fBqsyy4n8c6ZsnquyncNXgeeW
TLSH
T123C423C626490FCBF2B6E03C42D5069C58342C7DEBE9D21E4CB33E266A75DA575C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3e3c6ba7ca23c229dd07ebe42c8d98d494c74a668445fb4d7fa78424fe85d603
MD5 a3787a70c8645f6203a5fe085e6fa5d0
SHA1 a5bb67b9ae870f1d715675426d370e025f4dfb02
SHA512 34cbcd906a12fba089e5fc6507a8e19c42bb35c9186915e4c5cc095dd33bb02c53bd5145a606f5c3c4e27d3f7a3fee07506cd617ba5bb45ee3ab0979bccc2bf8
SSDEEP 12288:idcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:idqsyy4n8c6ZsnquyncNXgeeW
TLSH
T1FCC423C226480FCBF276E03C42D5069C98342D7DEBE9D21E5CB33E266A75DA575C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 602b94e3b7bf30ee927772bd7b6ae7191d9bf557654c458211842b7d81fe7467
MD5 46f0ad8f1a1dbc2db4722f6ffd9c075f
SHA1 ee567d1a5abb730917cf0d5336f2f527b7ea2448
SHA512 679d68c911e354818ec2ae39438780aba30a861ea8fa544bd5482d8ea3b9283dcf0fa5bd99988b38435d5fa1abb88ae2d443ed60b461341e5debd0c77b3f1c46
SSDEEP 12288:+yPz5L8wcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:jzywqsyy4n8c6ZsnquyncNXgeeW
TLSH
T192F40247339521F9E1769138C9A20A05F7717C364B64CBAF16A01B762F376E0AE7BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 79c39cd6702f20478305dd1aad6dbac312ea834e5eb8360d4780f337f215783b
MD5 0cb4458cc2c336baf9b393faa80ad653
SHA1 57d183a74a243a4ce7dd23673c7690ccb3a98201
SHA512 87c4dc37ba1575501455aeb61ac619ad7d3bc7a5ad06f6c908efe2a29e52cc66a468652923665015f08d6988f96e2f9e2e0cb6761268f50dbd03503f057e6abc
SSDEEP 12288:TBcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:TBqsyy4n8c6ZsnquyncNXgeeW
TLSH
T114C423C626490FCBF2B6E03C4295069C98342C7DDBE9D21E4CB33E266B75DA575C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e16949a20717a51f544d2c8b4a533937cf8c29ac38e416a2c2a58f0e75ea5941
MD5 2c46d225ec5cb861486c129123dbfa22
SHA1 7347b38352f8743ba9d69f0e0183d79892826d40
SHA512 fa0ed63ebe2e9fffa6e9bbff11ed3549fa5f6bf209ef5a7c70f5c5f9d5f8a6d20737eb474c4fd08ba0d0403a8a3e41c5cfa8ebb74a0a1e61078a13101ebe84da
SSDEEP 12288:EBcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:EBqsyy4n8c6ZsnquyncNXgeeW
TLSH
T137C423C626490FCBF2B6E03C4295069C58342C7DEBE9D21E4CB33E266B75DA575C3A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 be08ee19f4a0a7e0073761dd903f4daf3f5543ec638516c0ede5b0efbea3676a
MD5 b68097453e2d042915953b2efa223873
SHA1 3ed56f8748ea252fd6988f730c43878890b4b595
SHA512 7346445bfabb5fccf70e4a281da90abb24287787cfe6840867c71ee18d28c033a1b9de9e933797376542d1e2755fb176f721f73537c9f4cab2be320b6dec296e
SSDEEP 12288:1yPz5L8wcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:czywqsyy4n8c6ZsnquyncNXgeeW
TLSH
T1F2F40247339521F9E176913889A20A05F7717C364B64CBAF06A01B772F376E1AE7BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 7c422f0f09a341ed401862e4f60b26962fb67bb319b3c2f62d607a50e9938940
MD5 d315cd20b7de1f60ca8d76957b056203
SHA1 c86fd598adb80eea45fdb1e0dbd148d419ff2c4b
SHA512 b0e1bf4077d80e76d68faa0b30ea9a9b228c7465d0563ea65898996f2ed039bdb556975f34d6c272277a95da264e17a6782197b284fefda5beec124b42947ed1
SSDEEP 24576:SCUMpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAyqsyy4n8c6ZsnquyncNXgeeW:SCUEPTY+8Wg2lIL8lrIUJLWwqsyy+8cx
TLSH
T15165AE1EA3DC0896D0BB81358A518A16EB32782E1B32D6CF1160C73D6F27EE55E75F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ee82692140a2249a97117813fd16ce52ced52d90e573ced2ca4ae7346bdeb2b2
MD5 50c922112dc741c7bb66233b86cd9f83
SHA1 544e714908dccc29663b912dc2516105d6a34b3f
SHA512 62dfed275a1cda243e4adbe883eb27d05d3ee3ceee355cee522cef9f4070f884522d8c372502acf2f9f0921bf6f9f38ac58eec4db842ceaeb87c46d1210a5177
SSDEEP 12288:cGsfRcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:URqsyy4n8c6ZsnquyncNXgeeW
TLSH
T18CE4F14AD28802D9D06EA139C7954644B7333C2987E1D3CF56D1F93E1F76690ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 177ae55778f8343d27f005cb94470ad16ef057b99af4f8140071355e9a305aa1
MD5 ecd13fac07780688f4d253497aa8792d
SHA1 ae3d053de3bdc174a5217542d22e0a74c959a2de
SHA512 beeb57aa9fdade3d56eab7df6953c8ccdab52b0fa94f3554ce40220d013215c1ccb97294a4fbb88fb33efdd76ac72c62685f60f73808591ea92f478297eead5a
SSDEEP 12288:bOcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:bOqsyy4n8c6ZsnquyncNXgeeW
TLSH
T10DD423C2134C0F87F1BAA1384199422C64393D7C9F99D6DF98523F566A34DE1ADF2B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 ac2694890a69fefa7df558978a225a3a3060a9a9c3c8780fe7ed4292388990ba
MD5 79dc5a6dafb78a5bc721c7f3b327c7cb
SHA1 948932f05fcd734cb6b42299e85e8fea2f76550f
SHA512 36c12412d3aa759ee645a067f5ce5634417171e4d3b7c9fe8767fae220caf124ca9d558daf08abf55080b0954f20369992af1387082a1b47700bdb0900721025
SSDEEP 49152:ARZwQCyiHiQEaiPnMQsyy+8cGsquDBqW:O9xPPTsNMGtuDBq
TLSH
T10885AF1E62DC46A5E0BAD278CDA74407E6B278164731A7CF0191C27D1F27EF49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 676KB
SHA256 cd116ffa6cb6a8f82eadca6f36acd8d12f8585bfb624c630db5c2bd123207b05
MD5 d085d21ff5a9ccd7e66233ad4e8aafc7
SHA1 06f67f97302c8cdabdcbbb6b2f788927f1b0aa74
SHA512 713f73d31dd5b53688854407c6df3ee484637fb3059c3564031a5ff4a3a01684e173ca8c65a1be7ad690f1304eec961e082279f51d67feda95bb1f07f8fa2d60
SSDEEP 12288:MbxA1U7K+cziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:MbxA1UG+qsyy4n8c6ZsnquyncNXgeeW
TLSH
T185E412AE228C19E5F1B6E13C85D18109D7317C2A576593EF14E1A27A0F37EE4AC76F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9bda8384c514d84eeb00e2d6f6b62060c11f852a303d9505fb325eab2325ac08
MD5 94e5e4921a1aa588b9e2a3d9e40888e0
SHA1 13761d3ee2d5f0283eb7d815dc51b1e0757e7b1c
SHA512 84cba63ac74e8d31603fc19188ba8a6f57366933f0557a08cf9b0ea7866c00ce5966a9e275c27f5fea39d926d83f4b5801f5dfab56c463c639697223aa9110e1
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrnvqsyy4n8c6ZsnquyncNXgeeW:BjRP0yHfVqzlAsrnisyy+8cGsquDBqW
TLSH
T1C445AE2EF2B910F9D4AAD136454107B5BB71782D1F209ACB0170C635AF1AEE89E35F4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 cb0e032488187fa7c6f2d7264464994136ca5288e31e02c3f164c87c2e7a87f2
MD5 dbdb0aaa6038daa9ec2bfa9e5896f776
SHA1 b741e2a378ae272a3d9c2f3033444fb0eb53e822
SHA512 0c8870feaa6d03965f391739b7b15f12008a21de91e7848d894ad5379ab641e5893825f6900f0f166915e6a131f6d96708c45a135263c6ad79d9d0e843a2f6b2
SSDEEP 12288:uYcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:uYqsyy4n8c6ZsnquyncNXgeeW
TLSH
T1E0D423C622480FC7F2B6E03C4295025C64343D7C9BA9D39F48A33E265A75DF6A9F3A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 476769e2dd9400a169cbc8ff2f1cc58a6e647c45a3c0e320114013e2eda363bb
MD5 3699759dbbb2e1f19ceae8ab6b880661
SHA1 e73e16c759b1d6897248fddc6faa3de43c066773
SHA512 5093925f8fa35156e2f9df2543ccce330b20a5d4381fa7aec6ef946720b133f75f906eff89c676e3393c977f0e8c7bf7c6fbb1a383f08627ddbb9a3bbcf35905
SSDEEP 12288:wObvA4LWO+vAYFTqcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:trLBUTqqsyy4n8c6ZsnquyncNXgeeW
TLSH
T19B25F145E79404F9E97BD13CC9A28616E672786D0764E7DF03A84A661F337E24E3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 800KB
SHA256 f536c05267c59b5341871a699a585496b4677d8b3b83dc0998da5eeae5bb787e
MD5 990bde002646e0deb69f70a66e95e98f
SHA1 6f4b73ba5a08a6da1513d07671112411a33c4719
SHA512 1ada9543ce61a9e8ed10b93ba6f5331debdedf40126dd7728c79204402b19e4504c587f7089461912d5a45839d824222fa24c4e778cbc3004f958195a71ee074
SSDEEP 12288:A70VmuIYNvUyBpVcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:d2YNHrqsyy4n8c6ZsnquyncNXgeeW
TLSH
T10505F15F629C0DE5E57BA13D8AC28209F1727866175193CF04F0827A1F27EE9BD3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a6105221ebb1c47f6de4a27493c6f2fb651e60587f4fea992ad8766ad0f7c238
MD5 ead8948a7c46067e5b12badf7f177442
SHA1 67d64cd91c9fbf92faf0716372d06983457bad7e
SHA512 576f0d1d5e438f5c63b5d0c5b7d43cefd5fad0f5363353f0aa497ec5c8edd43b0cb7f168e58b78f89c7281ddcc800b0985803b6a0ea0acf892439720ab6ce0ad
SSDEEP 24576:HnXoJjNYH84VVSNAApoEOQ66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK3:HnXoJJYH84VVS6AmERJas+cHBjSSKHPn
TLSH
T16265BF9EA2BC04E8D5BBD13DC5C24506F5B178661331C6CF026182BA7F27AF5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ff4281e1cb201b13bdef820b9ecf1f670a83a197725351d6d20bed2f35e60165
MD5 d5016502c7ba9d2b9379aeb6cf1954d2
SHA1 de2ad66e4238723bdbc2ff729b2453b1d916c279
SHA512 ae235f710fe1b9dfedbd0f556f0266f16a6776edbb104b930c3c5c469d6903f9c544ba64541dcd2b5169e82e1cd96a5b4d089a0b11aad36a65a2525c2810c2dd
SSDEEP 24576:Yv7Xbxd9Tuycf8M/TYlSuxrr2PCNqsyy4n8c6ZsnquyncNXgeeW:YDLL9TuJ0M/TYj2Pfsyy+8cGsquDBqW
TLSH
T103858C5EA3EC42D8E0BBD6BD85B79146FAB2B855173081CF0291856E1F23BF0593DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 89d628763f08bb5b44f05a06146d2b58bfb3fd4210e5cc09272bca3695d620da
MD5 87e886bf020fba9827ad181a5ef62e69
SHA1 76bb18b66ca998e10ad6b475d8a87d032da02fb4
SHA512 f42c5fcb88b05f03908b67459abd0880b971929ddda9ab512739f43bdf30bb102e8067e991243a31076d123ca3889ab92942793703da1dbba6f850d4852f8580
SSDEEP 24576:SegJgpwJOmPOHWAKR8ZguIGyPsxr5Vin10wqqsyy4n8c6ZsnquyncNXgeeW:SngOJOmPOHc1syy+8cGsquDBqW
TLSH
T12255CF3FA7BC15D5E07EC13D8A968916F6B1782603255ACF0560827E5F2BEF46E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 904KB
SHA256 e11ff1a65dd57072de18fd1cef48f92e02ce7849b61d0253fc864b4a9da48d47
MD5 a4e88c9f29bd45187a7ae20f10116e51
SHA1 9a20fb77bb8312f4efefc9e4c7031d39c775e81f
SHA512 5c496b61c3d8c33704927d9922b9dab70f092014eb7da99247354f233410fd62111d1e7bee42e0454fc034b0b8c4e2859b7772627f795a26307a0aaa0f4df1bd
SSDEEP 24576:XLJnJiTk3R3waE4JrO4qsyy4n8c6ZsnquyncNXgeeW:XLJnJK8R304lSsyy+8cGsquDBqW
TLSH
T13615D06DD29810E8E4B7C2B4815A1756FF31387C2B2569CB59B4D5313F22FE0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fcac24aafdaf54f42151bb5b379d8d73dea2d746afaaa17eb9ae2ca45f309079
MD5 f514216d12f1161d2f518e859753846a
SHA1 f38382234cbaf2a6f57253a35e033d2314e6dded
SHA512 b69bca6c301d2a3925e4e32042125dbc6565efc23a2bac1603d1a9ebb3897ddc0a174b77297e958da8f42fb8d51c794fe2e6d5ec6d78f78e9d6a8cd3872f97b7
SSDEEP 49152:+9mqCzDScAZmlvTcFg8Ph67syy+8cGsquDBqW:QmsNMGtuDBq
TLSH
T165955C05F7EB5298E8B3CAF1C96294159B327C509B34F7EF0A80CA6A1E32BD1D535B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 676KB
SHA256 5bec57a4a07999f1f8688bd362bdf8aca2a5536a0dbd591839dc3bb08e90cffd
MD5 b566ac579b56e302b1fa30a956ea2fe4
SHA1 be7882487f98e1848578c708528474ff0251fcc7
SHA512 33743f43fbba2b95d561b87b24bb4719199b5d2b8bec2aaaffcb50ded7031adcacba0cd93b2204d1d10fbc5e383d2aa5833e7d022b68de41d9c0e75cf2c128b9
SSDEEP 12288:RlYJeXm5nkEUuEacziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:RlYJeXm5jUuEaqsyy4n8c6ZsnquyncNF
TLSH
T144E4128D328C25E6F17A903C85924648E331B8755751A3FF44E0E67A8F36EE56E7AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 732KB
SHA256 d739d997519c24076a61eabf1cd5e85aa420f7e62c6d6f7c7ac8fc5fb02faadb
MD5 89a4d2488f715f71e48bf30d8b5491e6
SHA1 ee6e4c4520246786839ac942cf285c6148a09ee3
SHA512 ce996bc77ea2629db44119b6df4b6e744b0a2c7ccebb5756b8997a93bfda214b62d60f681c317dfd7532d1660c57bd50b858172b67a15eb21dc489037d046d2e
SSDEEP 12288:Hmu6kyPcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:H7tyPqsyy4n8c6ZsnquyncNXgeeW
TLSH
T196F4124523841AD9F6BA513C86A241989E347C349F6483EF44E1BB3F6F36AE0B971F05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 604KB
SHA256 06f5363f46915f1c854946ef6eba83625265fbc359c9b356c06c94892e59fc0a
MD5 068b8dbfaa4127168d5426ae1695bf41
SHA1 9d186bb520b00c65c40832ad322b64eaaf38ed7a
SHA512 e7b4861797c7fddf6607c6ed3d54eb579d197fd7e256f5e317b20cc098baec8405329c00c7e3399e80884d6279c2e7633a9628465c31526496f226aa5f9a3f50
SSDEEP 12288:aPqcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:2qqsyy4n8c6ZsnquyncNXgeeW
TLSH
T17DD423C912481FCAF576A03C41A5065C64343C389BA9D6BF48F2BE369F759E1B5F2E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 496c57f3123580afea921dbe616cae44bd4b440e8bf51c6b7db1037efce52d5b
MD5 90245a8508889476e040c34170ed7272
SHA1 88a86c43d4319884c52d114081d646e0756b3b04
SHA512 072a85d5ad97c19c970381b8bb2cb4622a20c64171396c5aca10dbb0d917c04c12f33ab26bf8b9e5d34a696f2488fd8bcbac682b26983df5c857b15073f329d7
SSDEEP 24576:nC+TyQIu93VAumZr7jmxqsyy4n8c6ZsnquyncNXgeeW:n/TfIq+YYsyy+8cGsquDBqW
TLSH
T130558C1DA7E91DCAE2B6C575C8A34493E933B872137186CF2044C17D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 768KB
SHA256 e57497758b7e3d0cb6b7760ba119b42c116ed2e429799afd08db583f87d1c306
MD5 627a75b544bc5ff911aa0eef5b586cde
SHA1 9e49152d4ad4da34e1d5d8b1d4353f966e35624e
SHA512 013df9ea7aa20aa669af44bfdf8cc42fa88c516177a3575367045c76ba709eb07678503af4057d6551b70c0cf6f6c91be92f9531b9d4589a7e9a0c2a736d08bb
SSDEEP 12288:BcyrWOstaa3kcsmcziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:0LQikZmqsyy4n8c6ZsnquyncNXgeeW
TLSH
T1BAF4F04FB3AA0096E0A7C13C88854255F67378344762A3DF05A1CB7A4FB79E9BD78B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 92ad084f56f04cf5081c81fcb5f7c32e7832c667affa40395a30a38bfb9b20b3
MD5 782ffed6020dc6b4e8c30dc0502dd306
SHA1 92d7fd0f5a5c1bc24abfe06312a221f04e0c48d7
SHA512 34acdae74d9f705236972950aa20f8b3fb24330f2c5f5718a776fdde5776b489b1323d8dda1dce5a015b7dcfc5fa72d774074f1ed99417928754e35a54648e80
SSDEEP 49152:2pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPCsyy+8cGsz:DpC7b4+80GTkzsNMGtuDBq
TLSH
T148A57C3DE2B810ADD9AAC375C5461665EE71382E3F2055DB00B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0be2af40f21b156b7fa845a48dd38c3acd2768572e53e44f6f62f84945e20d11
MD5 07536a19d7e56d7ec815f9488ea2a5ff
SHA1 7a69aaf5d9bb6729b5a5706ee6814bef7ba3388e
SHA512 6921188d47b9e479f0cdfa3d2e4e5d4ab69d08e4d4930fb48516954f9341f50714501fade11d12dd7498eb34454aa89d2f672e95eaf39d95b153cb86dcbdc443
SSDEEP 24576:xSAwJPE1IDAo+4Kt+l4413AUQHqsyy4n8c6ZsnquyncNXgeeW:xqPCIo4Kol4KQKsyy+8cGsquDBqW
TLSH
T15755B01AA7F946E5E17AC774D663C601FB7238221331A3CF4290953E0F269E85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 956KB
SHA256 57826e1cd48f7873d3ff31f91694b223ff7586be0c198579df5c824f601ff5d6
MD5 50573d0418552307de2d800466a533f9
SHA1 0569b79b9f5377ef19df2dac1236366cf905ab20
SHA512 371722676f060c36b83e2a9f6adf3f73fbf7cc28ae5283738643bd7e83e92eef2016aa6b69dda5a2279814e373a138a919891c555fce8f1c05f2c09d45bf0ae6
SSDEEP 24576:kyLXPLcE94t3qsyy4n8c6ZsnquyncNXgeeW:ky7PoTtasyy+8cGsquDBqW
TLSH
T1C825D03EE65C09E5E47AC13CD6A38506F67238AD037166CB09A0957A1F7BEF46939F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 744KB
SHA256 31a17a82401dd9e41e5909d3d71662a316ab0e8b6bf6a1de11df792daf5d2e85
MD5 b937841192557ee887d587bc6c085160
SHA1 4ef4dc6202f33dabd2c4fbd4814ed649e6afcec1
SHA512 0133a1fcdd5fa4d37129ce5eefdfdfd54040b7f610ff2f52c337afe74d913dc58f94b38c935397e14090ecbeb38bdcdeab2a50105a8cbe26cfdfec085faf41bc
SSDEEP 12288:l9lyvj3IkxjbBz2cziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:lWv8qjp2qsyy4n8c6ZsnquyncNXgeeW
TLSH
T148F4128E128429D9F07A8238D166426890317C7A17B89AFF74D1FA7B4F35AD0E57BF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-145-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/228-149-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/228-139-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1032-232-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1032-226-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1032-479-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1032-236-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1096-104-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1096-111-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1096-105-0x0000000000570000-0x00000000005D0000-memory.dmp

Download

memory/1096-235-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1184-284-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1184-278-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/1184-330-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/1184-533-0x000000000B800000-0x000000000B99A000-memory.dmp

Download

memory/1184-294-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/1184-310-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/1184-287-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1184-535-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1356-196-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1356-188-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1356-194-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1356-475-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1384-184-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1384-180-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1384-446-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1384-174-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/1408-494-0x00000000007C0000-0x000000000080A000-memory.dmp

Download

memory/1408-100-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/1408-6-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1408-495-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/1408-1-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/1408-0-0x0000000001000000-0x0000000001153000-memory.dmp

Download

memory/1592-159-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1592-157-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1592-151-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1592-286-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1592-529-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/1592-527-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1680-546-0x0000018054FC0000-0x000001805515A000-memory.dmp

Download

memory/1968-526-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1968-246-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1968-250-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/2144-48-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2144-54-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/2144-182-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2144-523-0x0000000000750000-0x00000000008EA000-memory.dmp

Download

memory/2144-56-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2200-476-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2200-199-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2200-208-0x0000000140000000-0x00000001400E3000-memory.dmp

Download

memory/2200-205-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2388-103-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2388-17-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/2388-11-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2388-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2444-545-0x000001DFE52E0000-0x000001DFE547A000-memory.dmp

Download

memory/2688-44-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2688-38-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2688-83-0x0000000000880000-0x0000000000A2C000-memory.dmp

Download

memory/2688-37-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2688-80-0x0000000000FB0000-0x0000000001010000-memory.dmp

Download

memory/2688-85-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/3196-531-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3196-260-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/3196-264-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3196-532-0x00000000006B0000-0x000000000084A000-memory.dmp

Download

memory/3196-254-0x00000000009E0000-0x0000000000A40000-memory.dmp

Download

memory/3696-263-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3696-129-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/3696-136-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3696-134-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/3696-530-0x0000000000DE0000-0x0000000000E2A000-memory.dmp

Download

memory/3972-126-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3972-118-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3972-249-0x0000000140000000-0x00000001400CA000-memory.dmp

Download

memory/3972-124-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4216-266-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4216-272-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/4216-276-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4216-534-0x0000000140000000-0x00000001400C2000-memory.dmp

Download

memory/4304-59-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4304-183-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-524-0x00000000014F0000-0x000000000168A000-memory.dmp

Download

memory/4304-67-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4304-65-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4624-32-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4624-148-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4624-25-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4624-31-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/4624-33-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4756-86-0x00000000018A0000-0x0000000001900000-memory.dmp

Download

memory/4756-98-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4756-76-0x00000000018A0000-0x0000000001900000-memory.dmp

Download

memory/4756-70-0x00000000018A0000-0x0000000001900000-memory.dmp

Download

memory/4756-88-0x0000000001640000-0x00000000017DA000-memory.dmp

Download

memory/4756-79-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4864-536-0x000001FEE3180000-0x000001FEE331A000-memory.dmp

Download

memory/4936-95-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/4936-525-0x0000000000650000-0x00000000007FC000-memory.dmp

Download

memory/4936-101-0x0000000140000000-0x00000001400BA000-memory.dmp

Download

memory/4936-89-0x0000000000F30000-0x0000000000F90000-memory.dmp

Download

memory/4948-222-0x0000000000690000-0x000000000083C000-memory.dmp

Download

memory/4948-220-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4948-216-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4948-223-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4948-210-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/4948-219-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5116-163-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5116-171-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/5116-336-0x0000000140000000-0x0000000140098000-memory.dmp

Download

memory/5116-169-0x0000000000780000-0x00000000007E0000-memory.dmp

Download