floxif | 7dd9555659569ac8acead57239a6eef5068982678ea2775881b4500bb5712355

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample260522-thzppabt4t
SHA256 7dd9555659569ac8acead57239a6eef5068982678ea2775881b4500bb5712355
MD5 dc9bded98a1b753e2c4656cc9146bc58
SHA1 8b45eea671db8b83c317acafa362e5efb862fdf5
SHA512 2b82c581c6e07e379a916003148d688fbcb1e6cdcae37be8c044906f65c130eb5e24517a395988022b6d89d4de50fb303b9841f692b711c53b20fd1a9f9a4996
SSDEEP 12288:WA1QBsrqSXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw5BjvrEH7s:WyzqS3nQ/tbw/2Mkjy6Fr7g0ownrEH7s
TLSH
T1636512157640E3FBD5132970341D95519FEA283C1BAE9243F7001B5BBEBE3E24A9A3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x0006000000023216-2.dat	floxif

Custom signature

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x0006000000023216-2.dat	UPX
behavioral1/memory/1684-5-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/1684-53-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0006000000023216-2.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe

Executes dropped EXE 22 IoCs

pid	Process
1196	alg.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1076	fxssvc.exe
1644	elevation_service.exe
4336	elevation_service.exe
212	maintenanceservice.exe
872	OSE.EXE
1144	msdtc.exe
4164	PerceptionSimulationService.exe
212	perfhost.exe
4224	locator.exe
1756	SensorDataService.exe
4064	snmptrap.exe
4872	spectrum.exe
3512	ssh-agent.exe
696	TieringEngineService.exe
8	AgentService.exe
900	vds.exe
1956	vssvc.exe
3084	wbengine.exe
3328	WmiApSrv.exe
3456	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\39cc8c867c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000023216-2.dat	upx
behavioral1/memory/1684-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/1684-53-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f9c0fe004eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bbbf54e004eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000969cb5e104eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c26f84e004eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7b8efe004eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f645bbe004eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1672	DiagnosticsHub.StandardCollector.Service.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1672	DiagnosticsHub.StandardCollector.Service.exe
1644	elevation_service.exe
1644	elevation_service.exe
1644	elevation_service.exe
1644	elevation_service.exe
1644	elevation_service.exe
1644	elevation_service.exe
1644	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1684	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Token: SeAuditPrivilege	1076	fxssvc.exe
Token: SeDebugPrivilege	1672	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1644	elevation_service.exe
Token: SeRestorePrivilege	696	TieringEngineService.exe
Token: SeManageVolumePrivilege	696	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	8	AgentService.exe
Token: SeBackupPrivilege	1956	vssvc.exe
Token: SeRestorePrivilege	1956	vssvc.exe
Token: SeAuditPrivilege	1956	vssvc.exe
Token: SeBackupPrivilege	3084	wbengine.exe
Token: SeRestorePrivilege	3084	wbengine.exe
Token: SeSecurityPrivilege	3084	wbengine.exe
Token: 33	3456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3456	SearchIndexer.exe
Token: SeDebugPrivilege	1644	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 5044	1684	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe	93
PID 3456 wrote to memory of 1844	3456	SearchIndexer.exe	131
PID 3456 wrote to memory of 3372	3456	SearchIndexer.exe	132

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:1196

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3580

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:212

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:872

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:212

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4872

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3332

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1844
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4e231ea8580f6f6bb3d8db162b4f9f1e8c2f2e87de107e41bff81a1708ea19ff
MD5 08601d3346238f3621d01e242c138fd7
SHA1 98037853158d9446bfcb49f918af783b7c077a67
SHA512 d2e96c19dc7ce6e66a47c4342e1471e43ed0ddf283b22c2c3049096e2e663eae957372f6ec9f028e01ee4eb02a22f7403b6272b074f04d7507b258a95530538c
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0Q/lFTjN4:u3q6HjBILm
TLSH
T1D8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 128030538230a1fa593dd91db509e84f9e5b2566997abfb6f2fff284758de2bb
MD5 a2b1775bcbd105bf7c665d1f099bb4df
SHA1 dcc12bca153ec52f63aa128648c0e5e4824f5d80
SHA512 56d1427c471f8af37d1e5c522857b55c8ff6fa411c670625d10a72c5cd0c2b21977db53059cc1b7358afdafb3b0079c775d94694d92732951c53bcee32c17334
SSDEEP 12288:R1XLsswWkxy2lRq2czAXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:fXYfDtczA3nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T14565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d904311513c9ee9b1cf46bee9bd144cd2f3dde3072310a5ba0fbeb802b9849e9
MD5 924e948d2acb4be8301421b4a8c6f7f9
SHA1 9cf3303685fe0dee82f8745b7e91c53f4325ac1f
SHA512 9d570a5cd0534be787f10a417e65f20b40350ffcd935e3411939aa42c44183aa5f17661ea660f0c1063bc086d61f267844cd19f96b77cad75e1423ba9316e26b
SSDEEP 24576:r0Le5ji0hmxLrMsnQ/tbw/2Mkjy6Fr7g0oo:rPji0AllQ/lFTjN4
TLSH
T1BA859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7263d227d93d25ef140d7c52d6acc911d8f0fd63f625ac8622b3974958168137
MD5 8f8d6439a5a3a09ab32dbaa6f90e57f3
SHA1 8c43fdc1e6cad589c951a5fa0a119de1c332fd53
SHA512 a13513614f6318582d0042603fad2b8b807edea8ac335e987b45ff00ffa379eaca973801112340d85b39a1f3786bc29e16dca0ac606b2986729e0302311633e8
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWE6q8wyu+nQ/tbw/2Mkjy6Fr7g0o3:9/ezSC6vUzPvxHjy5Q/lFTjN4
TLSH
T155755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a68ef5f57c56c84a121a54b0563e1060cc279794c87cd2fd59cd6861bdfdcdd5
MD5 a878c0ce8814c2208d0d9b5060e1d37c
SHA1 04b57849df18b6ac861fbcc7a60dcda5c4410da1
SHA512 cfe4ea61a73ce7eccc2efbe13c20bacb203920741db048b111eaab97fa0844903e48c52e0a58c32c248429cbf1161d115c5d5592ca4861d13dc04190c8ff4b8a
SSDEEP 24576:XVbqPb88hv/l+6TnQ/tbw/2Mkjy6Fr7g0oT:XVO88hXl+QQ/lFTjN4
TLSH
T191559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f3348294339bab8f83ab9c37182af9ece96fd674146c7d9bfd9ce9c668562cd2
MD5 9d371c11470cd778ff93d46eaacfb601
SHA1 644cb8de2f58ae7ece6bf20483b0b4b5835205b3
SHA512 825269063d2e7ea4ca6bb671b44ba72f649dd86d860a8863e461a42027371c9dec2befa6d30f75c2807d0c72b586f738cd7d67b207d801c4af8c7b3eb898c586
SSDEEP 12288:az4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:az4nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1B25523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e3e94dd0c8fd3eee435ed81f8d5046e0e354ed7069b120ac0d7dff44dc02c0fc
MD5 1287a321017502708072cace45f5c40d
SHA1 9dd7799440c90daeb5a7495f486af0c70571954b
SHA512 2f2efb2d1f157b8402c56479372f462062994c22129d8ec7b7df95f825d0087ce544bf1ab83db08b519f024bda7730972ac6fca668254473ceec68b8261f93b3
SSDEEP 12288:2eBNUbTVO86U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:2JIUrnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b4c11af1fe9d620388f2ba58801ef793b81373fd741b54e07fe2854ee9746d4e
MD5 db45adcdf284a26f25da0adcbe4125fd
SHA1 3e46c44db1cb4e8e9eb700719fc8fdcf7fea31de
SHA512 2752b70c05360501bfca3efcb1c8f60ea24f0149a7afa36fe4d2a03a7692e77d381f83a9043b879664ab47448859368ef24a597980b422244ae0ad1a899c953f
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:QQvGAdlCEL8c/yRNw5CJLm
TLSH
T101267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f8d03def1bf18222c7549c2f252bd402920cfcfb60e1afcbd146d9f6d5f15591
MD5 13d8f26d84d0273f2ee0a8431c2c128a
SHA1 d220ecf7858af1f81725b58399a99946775d974f
SHA512 597c3749ee8916a1acececad433b8b21a40e15981aed6c99cf6aa620b88ac238f62f48ac2216ec9093b2bc5b3559e455d7204fa046ceb85fe5740e7f841b4131
SSDEEP 12288:PAwSfxL/2Dc39DLLmt0LDQewsAj1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgj:YQewsAjVnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1E175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cfacfbaa314cca2ecf344b38e340c6668c0b9831e019c8dccf49fab51b14cb77
MD5 a545f90178443b663c6bd13ce1e1ebf5
SHA1 78bb32f11717a7fba5b644e8542466c84e62717c
SHA512 09a7a10cdee10cfeab9c45aa06003db8d6cb46eb5e641deff0afa6d699e4dd95cbae71a94971aa6c92b08e0f97b5a21091902dd1aef6b353d945badf4ec91f37
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSL:tUEtQevvqc2W1cpV2EI32
TLSH
T1CB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 14a9481d838cfba6047dea016b2f0ddcc8d22d665a70ea3643106f87004aec00
MD5 61c89b1c36cd4481f3fa96c93d5f786f
SHA1 0979d03a9dbabcf63d99b481f238b71244ac054f
SHA512 b2ea494b9af4ea89285af78d6ee53fa7850a321e01dc716515e1a0cbe93e5d06e449932ed1b8896d845affdcc5390c9e67efbb526e528d818729b1eec4f6b48f
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/z1Q/lFTjN4:3oqtVjnmtLm
TLSH
T1E3D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 660058ef2c7de44cb47d263bd674f7b2af10360da33b7fe0c305d67b1c40f39e
MD5 cd119a04bb009eb157a07c9ef31d3869
SHA1 e4064400de3cecfc63844e2ba28c9e91c1906ee2
SHA512 718184733e885624229814c1928838072a56b43fbe4144e63088c82ee7e57d156bf5b79f6624ba92e21d7139347f469e4e25792edbf759eb9a41faeea1c72f0b
SSDEEP 24576:gAhGLJIFoiwtA5l7S53CnQ/tbw/2Mkjy6Fr7g0oJ:gAMyFoiq5SQ/lFTjN4
TLSH
T1C435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3a34008ebc1da75b46ef5d099d1f745fe69d25a9e08cdaa64194a95d4757e856
MD5 dc836ffd1bdcdcc0702928eb9790ebb0
SHA1 231470f556d4ec99309f63594d5e07432e1cfb44
SHA512 01be9e8be719f7c2220c390e95c1225171e9cbf19c0b57ea2685359d308f50bde65e6fe3255355cb879509c2f274c624a5dc2b9e71bd525c2b3c69acc41266ba
SSDEEP 12288:rmw5HEjsChN2BFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMY:qwuHOWZnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1DF65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ef60af364b7eb12482ca76e7fbbc2859d7161beb7d3bb452251ea5dc58b20cc0
MD5 c4c80da195d64db57a5b49e78f8b512b
SHA1 1af3ebd68ae055868bbdb91f7548cf38b21cd9be
SHA512 e608c218e560b77fa5e499e9e206cad3fd6dc4806082280b9badadc211e9e447f339a97edb15b772fa442782c5605b9068431079e373dee69f7fb334774476c2
SSDEEP 12288:SXZ1IylGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:qZuknQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13255126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ed96cfb8d31a37418efcf4e932cdeb33989f009a18d60450d134566346618e93
MD5 0fbce12794b2eec39e26218fc74ccb1b
SHA1 d3b17cc602148eb006b4bc098662eb79a0c1353e
SHA512 3533d5eb590c84a79ba3c8c777d0725b17df81f7df29d7a6e04f46e6dbe84acd7bf823a1bd8d5e22ddfd4e6f66f2e30cd6833431c507a9fac21bdfba4bd36e4e
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:RQRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T177667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 385062b6d462d5b5dfcf1825c4094689f816fac4148a8783b7cc923a34303630
MD5 609de22cc91cd63ea94e55c01cc4ef74
SHA1 8d966d77b07e11d350645dfeccad685356caa000
SHA512 887a40580407e6266a2ff179a4156f3c104357ad3d62fe5dea0f2a735e1fd9d5f280362f2ec2453cc15e137e6159ebaf9511adb80947b1190e09aacc7ea54502
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:uQRQyi36YOcPQLvw2gAf+PN3kLm
TLSH
T153667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c3247364fc64c2d81cbbbdaecfae9cb7d54617d1269516ef1345893bf83bbc3
MD5 c1d7ecc4d70d80422c0d7745700261af
SHA1 b30b82d345a9a86ba309b77757150dc69f4740bd
SHA512 5b2782c582dabab7f6559c99c419d29a6e214597c78d669f5af203da77ff4eb9bd7b44ad3d2396018ae18dd41e2a6ac7f61fa58b8f054c4342a70d6075ab6bb0
SSDEEP 24576:swvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00nQ/tbw/2Mkjy6c:S68Qg55nhheWu7PNU3/lQ/lFTjN4
TLSH
T1CAB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 85583f8320266f4f792131c179ce8c25b7626f12f651b49d6ab569cfb796a4ef
MD5 157317362b10d3c4c3ea707c0f6410a8
SHA1 2f467c2995ffaccddd88c22261241ad9cd0e7f10
SHA512 b6e6e43839f35a3f86d932ca1cb1115195d879517b72127a4c635ed20eed7e3a1e39c7b5a736067bf8922004e38b1d49c19dfdacaf7148d456a7db3bd800055c
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99l:ty5112gYy5azzVvL69nLKnhZbLm
TLSH
T141167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d3529763e708668b76ac88bb2b663cf068a6e89bc24d73fca635fde9767ab5db
MD5 9a1fc8d14aa5e81277a13d9d81ccd676
SHA1 7c83b41894f99a67093cd950b23af5ee349f1e96
SHA512 ae6095272cc3c8f947da417473eeebc34690f64e53c334553b7d2481e8baf4158e47f0bb71211cbd15d2b99b5b2c64f43c4dc41212321b12c66976ab36916780
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIQ/lFTjN4:bu6JmVxd2drLm
TLSH
T142D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4ae92d0c0887ff4e27f3a8958a2cf24da4a5c0d20e0a232d1d7dbb22dbe82edc
MD5 88358218fd9f04b276430d851a17ee92
SHA1 4ba0fffe83154a45c498daf502fab89d8bafecbd
SHA512 b85d3cb9663485b7cc5b306a8b5ad5eea058a009fcf7aeed6e38a986207313dbc2356fe20239ac0c9e3863a9a8ec5e39feee41c3004213cf84402e395d17240b
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xLQ/lFTjN4:RmifPbRtLm
TLSH
T1AEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9e81f339c2ac0993d8bc04522ad066110a2f27dd7cfd40d0151c4b55c6244b54
MD5 e2e41aafc7e4686b496f3c586fb556f9
SHA1 95fad9c0177dafe98831a4ac452f76c02a04ad77
SHA512 ce8f8730170d2566cc50d9e25f4bbdd2a621c3bba5484667361fcfbba748a33fe20906fe825ce6de7b2e6ed5c83b0e91cd1df08700a5b2cfb704349e6003ae1e
SSDEEP 49152:QSuZQIY0Be2KRRVtOnks6NMHqkQ/lFTjN4:K5dKTi61XLm
TLSH
T1FDC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9b8798fcae82ff147970b07f936fdfe1030454e725d599670b96047f864ad2a7
MD5 f9bee9ea335a70dc0ce5be8a15eab9c0
SHA1 519997fe2d247c2e60447369dddd07611f704228
SHA512 64df10b3a49680d2b31400800cf53ee4dafe1872bfa8b511680adba50102b0f36954fd9c094f4514f1d88a426aedf101f6212e580f6f4da486fc281b291bdfea
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5w3Q/lFTjN4:+X2iyphBLm
TLSH
T18895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3ef0bacdefc2829308b37f55ec9087accf99c723702fcb3bd745e4e20a40c2e9
MD5 07dd32340a22ea6a0862b55fb0657d21
SHA1 21006ceda18bd816ba98978d52690a21c9dfe958
SHA512 7c680b745ef82766a080058178f0392c41cfeb5f636adff5846bfedfb9c93e9b6071a514c7d8b1f783cd4fc91f708727db5d3486bb591d70f45bdf33e3f539ed
SSDEEP 12288:cwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:cQnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1AE5523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 dadda7ce0d59a7f29ea83ebd52e250d25c9fe455b20c3c3167f561a13b211a14
MD5 8083397a7257655056780a8636c44f9a
SHA1 90dca03f185c1b8f4563ad7fe47c8c5021de6f1a
SHA512 65525da0dc3130560b1e835d922895f1316ab1091c4334ce196d408b474f1f7093495a1c71395371568392f45610722b8503f2a69e6ac05d1079f638f1b693d5
SSDEEP 12288:cRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:chnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1F65523697965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 39007c9ba12fe4af34fff922951128d97828bcf28be493452f2881ca6e48700c
MD5 3d6d43bd3a246a992ef40ae2d67cde09
SHA1 fe81a16ffc077c2ff13223877465cea17b5d6641
SHA512 1939df62e3e101e51174a012f49c9b2f7a40f578e26e3513d0983b1c246d4c48630073c22f610cfdb9aa28895b617d0c1e71689b2fbffa340638cd683646335c
SSDEEP 12288:ZzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ZjnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1525523697965F98BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 848c56f1c0344944995c098ffd276e1dcd8bd61296536d361e38f873957c7e42
MD5 c454ad1a83891c4e1041c3f9c044c517
SHA1 62ad74457c1029a70a3f85bdc11c7444a2566f8d
SHA512 faf7a84fec4ec4f65a4335060e65c2113a6c50366e471c22067c8cb3f93741efb3dfea4e6e8a68cf07050b68cb98206ee12d955cd46c7e035b048aa1c02dc4b1
SSDEEP 12288:7ViGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:EnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1A35523693A69F4C7F92742B5CC928142E7BB3DC1BBB1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5698dee367054745c7ba434384c42b65dc7e39ae5cac1ec41bff5c958cb059ec
MD5 fac24e7a590b0fd7eef02a2ad2d1a3a2
SHA1 fc0b8f5b7ef53f573214e813b3c19823459d55e2
SHA512 5688fbbd15ef8e13a660a12f8c46f9c346b1117a89c02c6d4cde2c74a4500e3985c61d8baf8171be8333d69fdfc4d1d048a6d169e8ab748327ff14e2941fa21a
SSDEEP 12288:xqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:xqnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1145523697925F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dc924e303d69bf78fe88df789e328f43b2b63bd00f527d0c78fe5886321d0bbc
MD5 672102b3b8e0f48841e13e04844af4ca
SHA1 be6d948a4dcf9180fa99a42bccb0827075f4b61b
SHA512 76c3c7d02fa3e1744085a1d819b6ffc3d7aa79064b2a6534c0ed5a1c99ee7387896e422c08d641d1c1a0a741ab6afb596c5a1b930698ab512d751c77aaa7f215
SSDEEP 12288:vtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:vNnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T17E5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 21ddf6c039e886257903fde80bea1c685ae018e15e115198a73462929e9f9229
MD5 2b714b06014d5260695eee5e0784b96e
SHA1 3879282004ea289470082e3f2f0edb82cb72f534
SHA512 22746e121aaae6a2363ce4ba8900a238cb6a0781ca436e099c41fbb7a269fbb4cee8246f721050c184f91fae85c6ab4d18400d4e66179ba16ab5dd6aa9ba662b
SSDEEP 12288:iZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:ipnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1495523697925F98BFB2706F14C828182977F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 dce2c6c3fa9cf4a6ca727cfd11595cb84bc49fd658a97ca8f3e3cb7be2bcff08
MD5 6d593bc8d79f31c3ead05dbfdac65988
SHA1 7378255c26a93f3a17bc3b0c97924da7babc69f6
SHA512 a2eb4ce0f40d110a712280100d9004a0faa7b58d1f1774111b91e4b0d0604d4ca2a7bae2b14a2d1e7d5b78817f065b5b56ccdbcb3a85ea812c57f382a8187de0
SSDEEP 12288:7iZwbDzzFEoS2cPvyxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:mZM3zFVSOBnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T10E7501A9B35058F9EC67427ECC518906D7B27C5A1BA0C70F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 631654fba66a33ae3d5db291e8e6be612aeea6309520ebf8458fe6941dcb94e2
MD5 f312041f799930a60d3bd8f56520a40a
SHA1 6c6d0cc566bff68662c11b207aa9cf00555b432f
SHA512 58f2b449f895b7be7ddb6678e343733d926ccfd0b1b2adba39fb515bef4b000f76db2a96021690900b44222e5e97cd02ca9cfb114893b79fe5789b8eb1bab020
SSDEEP 12288:+0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:+UnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1595523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 392a977f277153815e74e52a76725f46e5eb3ae5ab4ff024f44abb2b11c4bb98
MD5 91d3cabb7ff4ab144298b666a348f20f
SHA1 0c54b14901b695a7945f7370ea63a9b2aeaa7045
SHA512 120274a3c819b7526338cf8c657908b070be6b0808707b7aefab61f27ece728c5158f743fb41c5b3b2bbccb556910d10af03cc7ce9dcbb0d396fd3f7b6168561
SSDEEP 12288:soGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:sonQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1405523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d021e7468d0088fff33d16e472c11eecfbe5716ad1bb1f2f011959ffe6249dae
MD5 7e8bda2f76f136de35cd92fd277fa4db
SHA1 a0748c1a88dc1d1bda0fc60e24df3467bf2824a2
SHA512 c2148128244b7bd6a2f1c7e811c2d3da7bc7b30147c13beef3b1e36fbd2f1e3ffcd25075158ccfb682a5c2f3f8d5324e24d1b70af74bfd11ae4263d9520cb6ab
SSDEEP 12288:7yPz5L8lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:2zyFnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1E365021773A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c00412dbf5c5a5c0c0b33717984879ce5fb1d74f0f209692c2cb86a360afb96d
MD5 d1d9dbd78d14db4174dd878e36f5f01e
SHA1 c63fa1f2fd1e402875395c944b91c06445421200
SHA512 b0370fda5542c75fe77cc87b2067195d54d30ac6f26220b87d533cdd647c9ec8bffbc53fec4747b1c4db1b02217af17a7b8e07820d384aebc068baf47d1eed38
SSDEEP 12288:O0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:OUnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1CF5523697965F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d71c1e436522fc58f7bcdec451f5645d62827d7b3245c00f4531d24fe63ad733
MD5 1959852f7b05800570dd6aa4f4a76a7e
SHA1 118480f93679f83587d3fcad8873fe3edd409396
SHA512 94f3ce9e76f004753383231d3eed99f5bc0d4ecb77cae53ccedf80ee7a49159db0661c60abc8146aca6a60a56624de23604d08903c05ceddaba9d30463e1f1d0
SSDEEP 12288:m0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:mUnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T16A5523697925F98BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 70b37f891fe48dd9d17913fbc4ea8ec71734a6aeff28c974a4be1e5d67ef73a4
MD5 2bb69afacd56fbf0f904bb32fcc7316d
SHA1 7307b477412aaa24e5e34b925bed321541802ff8
SHA512 6070d51f2c286a1ff682a851d7b1881a1d3573a623d4b52fd83760479936be2225847fd7a58e79a33cfd2ceb683eb720e7faed9e600ee604b07aaf71d8886fa1
SSDEEP 12288:ByPz5L8lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:QzyFnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T11365021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c51cb6a17a06bf9d3ed08932febcca97f7b154f5ddc7131dbc7d2c9f1ca3cf28
MD5 d1ecd5e5091b7730cfd4e99e90393fb8
SHA1 0c8a08ff8eb2a95b9ca258e8119b37ae91b24d1d
SHA512 5ba6a117d54e1ec082cfb52c7a89d3fde25e96aefe2b35a0438a4511c51388c65c1c8724e447b5fb7d0c4a64f1668e3afdba4108d90fbcde35e84d42c404a6db
SSDEEP 24576:XT0aLl3z0zDznQ/tbw/2Mkjy6Fr7g0o+:XTDLlj+Q/lFTjN4
TLSH
T1BF7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a55b875085369c4b0c1f03aef588b837049d68fc3370d7965951cc82461725b9
MD5 89607e2d057999c5a9a014f3316b7b2f
SHA1 e27ba5c7fba05ed8ffd6ef9addaee2650eec2a91
SHA512 028962d4f7db4d3765ce5f83b6bf7cf44881db3fd454d7f6d4a116e732b74e7adfd4df97c15b2fa7e713b8f7a5425f68f06d27b6d5e21077846faa36c439dcf5
SSDEEP 24576:y31d9CHKy7GZPnQ/tbw/2Mkjy6Fr7g0ok:U1d9CHKya9Q/lFTjN4
TLSH
T1CF85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 59c373a993e86e945ca80f953f29bfbcdd31cd4fbbd0632c0a22c801cd08e6f5
MD5 f74b55c873c19048706e08125c261d25
SHA1 93f65b3be1c7c090b7fd51c8b4838bca1e63a0e2
SHA512 6e0fefb246b96cb0635fd381b5563b7cdbcce505cdb7ca7a0e8cbd1e74d3944c0e024863dfdc46657a7293bf2355bf01ddc602124970b7f99c7258c5d6121e0c
SSDEEP 12288:RTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:RDnQ/tbw/2Mkjy6Fr7g0og
TLSH
T18E5523697925F98BFB1706F14C8281829B7B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5172b977398afbb1b3af982494f29e5c76bc7619d821b65e9a138dbc0c0d52f7
MD5 f201c5200e1f4b82ba62110beb68e76a
SHA1 a479a8f69f23546e5c89fe15a9294c846b98e88f
SHA512 977707c15275f402f2c3a937b29fefd84aabbe153213927f22b114a6fb99622a7aa36687c721d2829c477afe76becaacc97af7cbf2c9f258690057456073fc71
SSDEEP 12288:FFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:FlnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1765523687964F99BFA2B06F14C8381429B7F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2908b4e235b25f7f19bdc2ed64317363ad6ac5950bf958c98d35b2ec631ab491
MD5 4966718243b6b5a6f6cbdc343a81ee4c
SHA1 85d0f2ec9c1032aa96b0bb300e2cfb4b53c96d7b
SHA512 e90b6a83c470ac5e7273b1b8421ffec3e2444bb0f4f2845a34cac3e9c73da72beb9837c093f7cbacf34bf45a0cfae137836e4d09f87cdb5cebe179c4dd2ec721
SSDEEP 12288:lssfEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:FknQ/tbw/2Mkjy6Fr7g0ol
TLSH
T15E65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b72c2e9a35591b2d524b86bf41cd962a2906e12085573622ced30c19724771d6
MD5 b8e86cc202fcaa36a5a74f6b91f01158
SHA1 f58e1193a006f590def46bf5de5e3ac21c8bac77
SHA512 e5a4f987a524d4a382b3e6543bbdb9a2fe39bac301ce68dbd408a251449888b46ac2c40a25fcc6ef300158f1e6c10962ff0e3caa13ad74edc2a364a3dfe82150
SSDEEP 12288:V5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:VJnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1F05523396668F94BFA3B16B05882C151673F0EC5BF90D38FBB08222D957C3D41EA6745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 d8eb4e68950ca5eb567804640a6916d1618ad4b131ad602d62149904e2261099
MD5 cca2af3355a04d5dd6350f0a58e4eb35
SHA1 2f0e19324062fc3bb221d4a26b1caa46ffceb15f
SHA512 763f1a179328801cb422f3d13d790b7e45b6652de5ae3f113bda23c9eb189efce05b15417def920a1fb33afe349158b188aa7f3d2cdde3ba4ad8a556d5f8ded6
SSDEEP 49152:Xa0h2GEkuAe73q3pp46zwwQPQ/lFTjN4:Xa0hNYG4JwrLm
TLSH
T1FB859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 33f3b5628ad53e41cb69eb688a23c14320b27bb982f443e635cbdc3a4ac4f45f
MD5 555bd1cf08a27e73b52256db71e49fb8
SHA1 4f8087c2d32fe6fb0f59c711a845c5c17be7d0fb
SHA512 e41ce8d517d422f1a0721a819c116bb92e5616c952a72af10ad9c0e159facc55e932ad2aae8b9592d11af68104c21681cab00457f71be06843723c1056f0c1e7
SSDEEP 12288:zhbHjfXGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:zhbHjPmnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1EF55027D26AC20DAF63692BD88928546D7327C552B11A3DF2385423D4F3BBE40D79F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 11b53291b81488cf79b6bd2f3e11420b36317da9590950fb72057d76609aa2c0
MD5 b8422d2d0b0057011d7b7dc5431bfb08
SHA1 0b843feb399df2f1028a374b7967e4ffacd26d21
SHA512 ec984afbcc41c8f4700bb549761690827927c9b7f4658bd5a7486628aceed37e91e517732b76e3a5d204d104b0bc63284dec86f1d93bd7a8389b81a7281d4202
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/OnQ/tbw/2Mkjy6Fr7g0oq:fIgnaTk46pBR/OQ/lFTjN4
TLSH
T18545BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 9cb8b4a91a3f0aea7a050a593269f5ef3ad22b8a8a1a89acf945c6ed3756c112
MD5 9ef207b1a0127de336b875adcc0c1c14
SHA1 713d317df8d36c8424da1789febfa17555312184
SHA512 d07f50182b7620f3a20c0a4de2bdfecb78b68cf2d7794107264939b0b8f25029762e57f1c2a09e3a27be59cb962dcfdda1aa7924c05e8bf610ab9491673a53f9
SSDEEP 12288:ZlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:ZFnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12E5523686614F98BFA2B06F54C838546673B0EC17F9193CF7B48222D967D3D41AF6780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 ce43d6eb62534d0b66dc8c7cc287ec70104badea754c9c0222859b923b95197b
MD5 f2bae56d099055e1ed82f9c892c83d07
SHA1 81ff9ff8051872b3e84ff8b31c5ccf455492d4be
SHA512 e5fd60aca180349306edb62918d4483cdaeba806ae5468e77e3d0b69efc555d0d6a5e934cc8f980e995b2ac6a70d7b98fa4f126650069a0f8c6fd5a730dbf7de
SSDEEP 12288:COb4A4LWOsvAYFT6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:zwL3UT6nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1D875F155F7A450F9E92B817CC8A28A16E372789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 bbb46f546206dad1f4ee70cd12ab4716dca2008bff32cbbf74c68b5093d05dac
MD5 b228c76e34e6074dd7179a378661aa33
SHA1 c53c938225b71a9448e857af8947d4a044a8149f
SHA512 cdeb31618e71141098c9e54e660d773f0dbc613622d44bbe05eb64322a0b0d6cde63db3b0630263665211f7724a651663ab1407046f43999fa598ea1df4264c9
SSDEEP 12288:IpFtCO2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:xOWnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1C555022D36EC60E6E536527C89838249D37278961B6253DF0780817E5F7BBF81C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6ad9f4d538eb35de5c7e5ddabf9ed841ec3c641010748d6f4f49cae4941d785e
MD5 47064c693d02b6f4081c8c89424ee174
SHA1 702a124beb57d937beedcff04302f7a3b0b7a909
SHA512 5f93ea44e0cbc4633d8660d5ba614fe4122fa4374e5c09b317b70e6ac7eae6ad3ff26f1df85e63360eb1dd47773d07a3f7a02f025f80f78e84cafec682343808
SSDEEP 24576:q7NM9YqZqmWMUkPjZM48Mv6bEhsZnQ/tbw/2Mkjy6Fr7g0od:q7cBWMpPjN8DbEh0Q/lFTjN4
TLSH
T194659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 072cf103799db57c059239553285dcda6cd93fc39596def70758faf1786463fe
MD5 6c59ab63686c729cf27fff8060d72753
SHA1 230c108f1f217aa92a81dcef76d0b162187cc2e9
SHA512 27f935bd4e02b36e43f3d59662e57eca8ed720d1ba231ba7699a662cb8617cedc9ef275fef0a1defdd88cceaacd604ad53a7b7ff14f177b7f6f3c8fd316c5855
SSDEEP 24576:SW6BApg2YuyuNDYTabvcdvNYf8km1znQ/tbw/2Mkjy6Fr7g0oG:SF2YuHNETovAvNYf8km5Q/lFTjN4
TLSH
T1ED857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 568ca38ec0e43e74ed9da4fb417cb0e331167bad639fe9dc138ea5d354659d1d
MD5 308f9627f0c6a94827180dc63526f779
SHA1 83537126d6022895de553ebf5884a8ca0fbe647b
SHA512 539ca809867b513b57bfc182a4c38a4690c3395afa28a59b58b7ead4d28aadc98981925aee81f2dd17c12593dd7cd113cc5872761d3b55033e3bdbf3402884c3
SSDEEP 24576:YAFs06+Omlf3NXEbToinQ/tbw/2Mkjy6Fr7g0oQ:dFs060lVXuvQ/lFTjN4
TLSH
T16C65AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 b060fbc450fc25e77d077a89bbcb5ff1a615146edb2b8599440d9fe5349360df
MD5 87daa46a35b998405af5f16111d41fa4
SHA1 d1aebc20b7022287e510cd0c1180358c68cdb4fa
SHA512 62e04b476777fe186eb195b71392917130bb3e64173966212e5308a45559ddcda6209a24300fa349d5d3ca888c8bcbe45181d7a11ec04ecc28692a27ce8b2f57
SSDEEP 12288:JCJnJ5D3VkrqzxpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:gJnJ5D3WavnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T13175D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 3780ff038d3dafbf1a1919da7cf50169574940b4935f6db3ff7ed4438f551745
MD5 cce7229fccde4ba6c78f556b582b6c80
SHA1 a87620d9db43a087b423c9afffa6b9e7951de9d3
SHA512 81b7e6729888bfc1a0463c9fd4f710856647ef4460e7c991d8654613b63d9fc8acf183fedbe194867617c09e29ab58edeaaab10518bd31fe23a6855b152204cd
SSDEEP 24576:REPghm6/7IIXdwcXrif7qQncjlP65i3VusnQ/tbw/2Mkjy6Fr7g0oN:Wg06DIKdwc+eQnSt65aVNQ/lFTjN4
TLSH
T175955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5674f867e9215193c8106136e169468303ffe53f1a5bc9d979f25c5e3b3d8398
MD5 01d8ffcb6a1e68f8c523551c43b29c10
SHA1 e2daeeea023d37158f2766297d9f6703e944cc78
SHA512 4ba1d8fef9bdc747bfb0c388b8395d380f7cdf0397571cbc29bb685d4405bd577f54cc28926c0ed45cf1e61a74d03fe36f8af2a692a2bf0872c9ce8e0aa9d0bd
SSDEEP 12288:LEP3RS9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:QSdnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1B855126D37ACB0EAE52A517D88918145D373F4A16B5267EF2680823D4F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 144ef08ece6b08ededddb09b3feb91e04223d59441b15376ac1745fcfafdc7bb
MD5 7cb5e28fd03fb8e07feacf8246f695fb
SHA1 09b745fb525c56020745e49f1525784a293e7303
SHA512 cc616680e231fac753856a4256fe2f408280ee6033f1588048da6bd879421d0a64ac5b630e5140af66bcb7c3c87bd0f0da38e1a7b028dcf2bd438cf1138f584d
SSDEEP 12288:ajkykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:aIyEnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T14C6512186398F4C6FA7A06788DA381919B367C506F2193DF6280F23E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 feb6ce9db89fe65e45c8308160701fddc04b1e46f41910c6267a5be9e45535ce
MD5 5b3180f5a588ad9899698cdcdaba965c
SHA1 5aa5459446a0b1c07aa7dbc27112196785265d38
SHA512 f41040fe47cb8af8ed752f14bfac6967ad17df1473ceb8703b0f2e51e3dea2051da0e0c991d9dcdd15d9c74eafd92a713dc1a1cc017ca35ffc4fb38dbf14e833
SSDEEP 12288:z0mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:AGnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T17055236C2624F89BFE2706F448928582973B09D57F9163EF36846239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 dbe93f2270544d80aecac014b5e2bd2872c9161dc76e4a4267a2558f15153090
MD5 e5b10101f1cf6cd439022f8b984fc932
SHA1 5445b81f7afb9b6f14277ba041591b22be378e2b
SHA512 982cba872d6b92ee91b318d399163103d734bc266737bace5d915a784084f3ebd8fd2220da1d2a8e6b058b2411ac0cd2c3ec695d6ee865465874ecb4fce614fb
SSDEEP 24576:7Q9MxZKdcz9dw3hnQ/tbw/2Mkjy6Fr7g0oa:7VKZhQ/lFTjN4
TLSH
T1F3558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a7d9c2fa601d896aa91b2a929a9d7dfce3241b7a5537a79fa7f0c145c382e2a7
MD5 a720656a50c1b25d0910a70cadb511fe
SHA1 836764a94b5df81d3ad3a82eb63bf6a6522b8878
SHA512 34dac2fdb0317d6722ee47f3515eae9eb0ad39c31c067e9c0039e6c9f214de14a3229af0911b88ecc11fba8ff3da39f6721679aba0c37c226237057377c94137
SSDEEP 12288:5yoKo20Rple9pQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:5yocSApwnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1BC65E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 72a53fa4e3168a7f9cf49299e09537dc4aa9ba04a8f8fe015d9489b7d478c12c
MD5 af68111da1f11a0626ac44c594d39c9b
SHA1 0df7bfd8c5684cfd49e9aced298f15b69a5d4771
SHA512 1ede46a5920995258858b3efc5d48959570564c8417d602560a23caf61e7dd5c3bf21398b037f37e00c2c1a833fb7d921ab9297818af2aee442828670dc5e75d
SSDEEP 49152:lWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKwQ/lFTjN4:V0zuNI1Lm
TLSH
T1F0A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a66082b7342eb81d4c93b4520c4e8fe8fb4970e528e36d1e2c0c6cad7e643cfc
MD5 fcd63fe80859a9bec1df768ffddf793e
SHA1 58e4ac106b5460f839632aaa0916d4f7ae90ee85
SHA512 60029340b4e9c51358a5381a697108f976d28bbaf54357c290a121adf1f98bff2457bd7d1004c0dc4a87d916cfd73ca7e36fa5d2fb68343fb87edd8e1e718a81
SSDEEP 24576:31QT7EcpfxR+N5AWAz3ooiYtjMqbdnQ/tbw/2Mkjy6Fr7g0o1:KTDxR+N5YzTfjMkQ/lFTjN4
TLSH
T19855B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/8-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/212-272-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/212-69-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/212-75-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/212-329-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/212-78-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/212-271-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/212-277-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/212-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/212-80-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/696-314-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/696-418-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/872-90-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/872-84-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/872-245-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/872-83-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/900-419-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/900-322-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1076-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1076-35-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1144-321-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1144-253-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/1196-240-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1196-19-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1644-45-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1644-39-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1644-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1644-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1672-30-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1672-242-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1672-22-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1672-31-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1684-0-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1684-5-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1684-52-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/1684-53-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1684-14-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/1684-7-0x00000000024E0000-0x0000000002546000-memory.dmp

Download

memory/1756-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1756-420-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1756-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1956-453-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1956-327-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3084-454-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3084-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3328-487-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3328-334-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/3372-426-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-429-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-462-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-464-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-463-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-461-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-459-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-460-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-458-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-457-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-456-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-455-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-423-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-427-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-428-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-430-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-437-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-439-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-440-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-443-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-444-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-421-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-422-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-445-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-425-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-424-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-432-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-436-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-435-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-434-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-433-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-431-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-438-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-442-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-441-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-450-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-452-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-451-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-449-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-448-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-447-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3372-446-0x000001AA09650000-0x000001AA09660000-memory.dmp

Download

memory/3456-552-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3456-339-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3456-409-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3456-375-0x0000000001920000-0x0000000001930000-memory.dmp

Download

memory/3456-359-0x00000000017A0000-0x00000000017B0000-memory.dmp

Download

memory/3456-415-0x000000000C320000-0x000000000C328000-memory.dmp

Download

memory/3512-417-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3512-309-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3512-311-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3512-303-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4064-288-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4064-411-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/4164-325-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4164-261-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4164-267-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/4164-257-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4224-281-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4224-333-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/4336-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4336-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4336-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4872-299-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4872-297-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4872-414-0x0000000140000000-0x0000000140169000-memory.dmp

Download