floxif | 7dd9555659569ac8acead57239a6eef5068982678ea2775881b4500bb5712355

Analysis

max time kernel
150s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Size 1.4MB
Sample260522-thzppabt4t
SHA256 7dd9555659569ac8acead57239a6eef5068982678ea2775881b4500bb5712355
MD5 dc9bded98a1b753e2c4656cc9146bc58
SHA1 8b45eea671db8b83c317acafa362e5efb862fdf5
SHA512 2b82c581c6e07e379a916003148d688fbcb1e6cdcae37be8c044906f65c130eb5e24517a395988022b6d89d4de50fb303b9841f692b711c53b20fd1a9f9a4996
SSDEEP 12288:WA1QBsrqSXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw5BjvrEH7s:WyzqS3nQ/tbw/2Mkjy6Fr7g0ownrEH7s
TLSH
T1636512157640E3FBD5132970341D95519FEA283C1BAE9243F7001B5BBEBE3E24A9A3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif persistence privilege_escalation ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x001e00000002b377-2.dat	floxif

Custom signature

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral2/files/0x001e00000002b377-2.dat	UPX
behavioral2/memory/4440-5-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4440-64-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4232-280-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4232-331-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4232-425-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4232-435-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4232-460-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001e00000002b377-2.dat	acprotect

Executes dropped EXE 22 IoCs

pid	Process
2204	alg.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
2468	fxssvc.exe
4608	elevation_service.exe
3544	elevation_service.exe
1168	maintenanceservice.exe
1192	OSE.EXE
1904	msdtc.exe
3780	PerceptionSimulationService.exe
4232	perfhost.exe
2624	locator.exe
4956	SensorDataService.exe
2896	snmptrap.exe
1416	spectrum.exe
1864	ssh-agent.exe
568	TieringEngineService.exe
4968	AgentService.exe
1112	vds.exe
3668	vssvc.exe
2524	wbengine.exe
1204	WmiApSrv.exe
4588	SearchIndexer.exe

Loads dropped DLL 2 IoCs

pid	Process
4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
4232	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	perfhost.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\48707521fe8d2f74.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001e00000002b377-2.dat	upx
behavioral2/memory/4440-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4440-64-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4232-280-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4232-331-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4232-425-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4232-435-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4232-460-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_175984\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094081ee104eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf6f99e704eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000520170e804eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	perfhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	perfhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007bed70e704eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f96a0e704eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000460451e804eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060d63ee704eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	perfhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
5024	DiagnosticsHub.StandardCollector.Service.exe
4232	perfhost.exe
4232	perfhost.exe
4608	elevation_service.exe
4608	elevation_service.exe
4608	elevation_service.exe
4608	elevation_service.exe
4608	elevation_service.exe
4608	elevation_service.exe
4608	elevation_service.exe
4232	perfhost.exe
4232	perfhost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
Token: SeAuditPrivilege	2468	fxssvc.exe
Token: SeDebugPrivilege	5024	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4608	elevation_service.exe
Token: SeDebugPrivilege	4232	perfhost.exe
Token: SeRestorePrivilege	568	TieringEngineService.exe
Token: SeManageVolumePrivilege	568	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4968	AgentService.exe
Token: SeBackupPrivilege	3668	vssvc.exe
Token: SeRestorePrivilege	3668	vssvc.exe
Token: SeAuditPrivilege	3668	vssvc.exe
Token: SeBackupPrivilege	2524	wbengine.exe
Token: SeRestorePrivilege	2524	wbengine.exe
Token: SeSecurityPrivilege	2524	wbengine.exe
Token: 33	4588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4588	SearchIndexer.exe
Token: SeDebugPrivilege	4608	elevation_service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4124	4440	2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe	87
PID 4588 wrote to memory of 4328	4588	SearchIndexer.exe	108
PID 4588 wrote to memory of 876	4588	SearchIndexer.exe	109
PID 4588 wrote to memory of 848	4588	SearchIndexer.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_dc9bded98a1b753e2c4656cc9146bc58_elex_floxif_redline-stealer_rhadamanthys_stop.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "SmadavSecondaryUpdater" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4124

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2204

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4600

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1168

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1192

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3780

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4956

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2896

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1416

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:996

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4328
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2600 2708 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:876
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2880 2876 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab9988f1c3e9076cc665ae4842b7367cc4b2b85818a240fed5974af9f1c649f5
MD5 21f307d7e06aaa54ccd2cc58368de2df
SHA1 75c24d892c0591e267c6e6707aa9876974b6d1cf
SHA512 e3315e6ccc127523f36737d7fbc4bf500ca175b54ac755efabd9450458ff28f6b512d7ced65d36f36bff806d72cec3dca6b7082d67183e57db21bdda38a851f6
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqQ/lFTjN4:S3q6HjB2Lm
TLSH
T156D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b313442d330d06c9875ece0c361b6da8064cd09a97ebc53682e3b31982c265c2
MD5 afa2424ce5bc8b51e148f9440d03d43f
SHA1 5bd3954ee73dda7577f476f1917a3a3b43f3c198
SHA512 4c8f7417f1ccdc75a1aace81e6ab7467b9b0e93ef46866a3533d44ba185a649cd4e878bc22d74c3f2cdf14b5505ab822e353b0f56d21d6682d3d301dbfb75b82
SSDEEP 12288:R1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:fXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T13265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c97b061e4a1966f6fcbd26cd2da977fe816873e225acfdd72ef265e580e50a36
MD5 c5ea3bf6a3cc733e0a682bf00e538715
SHA1 77eb9453afeaf55df8d8d56a3ae25297625836dc
SHA512 3c52a481408bc1ea3ed5743c5f6e550b21a1ea73a8883126ddb09cae04b7e916dbf6226482b442dccea03ea82a08efc1949bf6bb02671b190fc11cb0cf6e8610
SSDEEP 24576:W0Le5ji0hmxLrMvnQ/tbw/2Mkjy6Fr7g0oI:WPji0Al2Q/lFTjN4
TLSH
T1C4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59e85989b335fd84598ad7c52ee900ea96c4925f932e50a6bcec8baa7bd6e3a3
MD5 2aa0a10127930c05dbddcc5f730a4b04
SHA1 9038b79a78b520541d2af321fe83e243feae3605
SHA512 d5f223ae86605af364bd26d6a66fd4f24c35004faf2f40d5bb9892b6bb084ea60cfc4ad41dd53c2aeb2aa4ceb576cf911b3851ce394e622b66bb9712e493c8ec
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuZnQ/tbw/2Mkjy6Fr7g0o5:H/ezSC6vUzPvxHjySQ/lFTjN4
TLSH
T143755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7f746d1b296bab617cb69595451f63cfd3dd8cbbdac87d3457e28d5e7c7cbe21
MD5 c5ba678fe433a0e5c1de1d223747c931
SHA1 3576bfa5185546a74e621241fc7b854c4e140409
SHA512 9a87b33613528d02d570e8a9423864cd07a2aaace0e43a40ec9058f53de89470b465245638f542f3041c9c275a363c867baab7ad1c01255290fc7ce2e69ed83c
SSDEEP 24576:iVbqPb88hv/l+60nQ/tbw/2Mkjy6Fr7g0oA:iVO88hXl+7Q/lFTjN4
TLSH
T193559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a19790d236117abca5a4f0a17d8b32c200dc4fbd145d4e0f354b517d4a30f280
MD5 339048cca75f6b117af537e9eba7a6b6
SHA1 0b7ee913723e2a4ea3916cf1b318183a57b53cdd
SHA512 76500e9fc66f1b2db42bcda2bb97131326f15f1d0359a1a9da65d074287a65a6939e6725db0a1d4132c8faa57be20a2103bbd247d4c51cf1271e0753333987b6
SSDEEP 12288:azTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:azDnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1335523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3cdc15bad1189209376dbf77b534ce8739228a4b0488c775a05de8946daf768a
MD5 7ccf89c520c34e358e645e103b468520
SHA1 1620986834546fed5e4a069c3f7ec05ab82d9c88
SHA512 b94550f31c256c1b1350681eb89582b16ea94f335f8360684f28d99291018ea66e5bcb6e6b44a2a5cf0d37a1e6383d3c64df6340198f0a25c416899a6b9c224e
SSDEEP 12288:2eBNUbTVO86UMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:2JIUMnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T10C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164820EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 83ee449a4cdc4ee9058d6c287a4eaefa722bf44521144592de0999d63c176633
MD5 91dcfe4c1b7edd9f9dc296984c7ad4c0
SHA1 3df3109ea87b12129b883c3df1f7e8ce50c74ab5
SHA512 1646bdb7055a45c1bbc0ff791e001b20590be91a4f7c94ee87a5167b23ee49512ecb9d53b9661c4909a5afc79dd296c8c2ad91b8bdb2228205b78e59d570ca69
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH6:oQvGAdlCEL8c/yRNw5CeLm
TLSH
T1E0267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 14406908783a6bed01c22314cee008a31697133daa91f274ab8fb0fc36359d61
MD5 c79ab595c9a572b6222c57ec2ed4903f
SHA1 70cec985945639c45d4377a892f66231f6141b6a
SHA512 770cfe3221a68d0be0942bc79350ad2ed1a6d42ef4f63472ff96d458feb461f2199bd985013dab2935256c1b5e021fc3007e95daef25e9e10608ca37b0c4dd3b
SSDEEP 12288:7AwSfxL/2Dc39DLLmt0LDQewsAjmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgv:kQewsAjGnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T16275E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7a4cfcf69280e6ecf60d227ab4ededd10322ee165d158c83ca939911fec94776
MD5 e422b6ef64aa3aab9f2fac397e7a9c85
SHA1 889bc127a5e90fadd4b05b320f347e4b29131a41
SHA512 2ea110dc7622208f0201a275c0eb4ea6052315672bb575f8fd5096b9522094f84939bbeda1839749184c5d329837c3da3c59faad605c79f28d782bebc3aa7d8b
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJL:yUEtQevvqc2W1cpV2EI32
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d2eb59dbf0c25e31e17ab5b66ca4770af901c2b65eba667b19faa3312562834
MD5 2d968458c43aadfedf1767f1ad4cb939
SHA1 bfa825033148ec5ef4bba4afbce9d30f4bd4c32b
SHA512 993551d540e429a36615386c02d4f0d076174b014c4bdfb14a9eb887d9da2e16368b9b12321ff2d6fee534e58ffc654626671d340caea2120edab986ecf41764
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zmQ/lFTjN4:RoqtVjnmqLm
TLSH
T19BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 20f010efe43d4d157b7974dc20bfc2f8a721886d42ab34f4f91b60fe9ec6678a
MD5 23a93d8b4773eeccc27a4ff1c57a2788
SHA1 60416b80cdbb68595955f1f63d461e5102c8fca8
SHA512 403eb1eac4a7920dc4a1be003c03d22fef52bc3193f0c75afe3d6be702a9031541537121bf3a42836aa1f582878cb0d7fc1f010c07ee54960d1e8d296b26ba28
SSDEEP 24576:RAhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0op:RAMyFoiq5VQ/lFTjN4
TLSH
T1E035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 61ecd670f4c0609fb692100f1413408ccc960cdf55f6669b7003fc3d09087eaf
MD5 ada270ab9432fa3663a0d418b2791fb6
SHA1 e06fdbed40721036fbe1cf250e596329d8885895
SHA512 cf42c03af93cbd24bb8a902369bcfa1feb3d1e61b67b872c1a5ee02d00965d2a38314899d1ffb4e685acfdb3e90f5e7ca91ca3be35aefed0f01d7ee226d57509
SSDEEP 12288:imw5HEjsChN2BFgl0WDm+CpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMq:7wuHOWynQ/tbw/2Mkjy6Fr7g0oT
TLSH
T14565F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c62a57fc3fd651ee817b9c6a5cf667f1a11eca35ea0ed132c44ce68fc9dd6bd0
MD5 a883ba3e5032002bbacdedf61fa6ae82
SHA1 ff7cd344f1764500e41e3e201561930d215b46aa
SHA512 4c4caa275d2bd0cb8bc38377fdf97f6e6dae37ed98fac9e31c02a88ded9bfb0c499321259e79dd921c040c23171dc077fc97da433be9e4cdc9f0c6fd05fbad04
SSDEEP 12288:eXZ1Iy2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:uZuHnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T14855126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f63f1be3c0e0a7381a69e7e076d387691bafd1ba90740151c90f84b3e6c978c5
MD5 06bbf792be2735110a7a1034239bff58
SHA1 88bdd72100c8df5a71f76a786e7cda6952243dfe
SHA512 531388c622fad515bc7ed13f833189503079a8bcc6f6f9e498dd1f2196a5fc4e1d314ddb31cb1fadc55656169f0b00a08f5d5e022a52e7b7de040998eec3b463
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:JQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T1AD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2dd8c66b60f20a42754b123378a0aadbad4cc9cfd468222acf7524ec39b054f0
MD5 e06b94a6cf540a63e2763eb51ea7be6a
SHA1 67e081c217872f155d12cf8325232dde14f2c8ce
SHA512 2f7eb7d2725680f72114549fc50d0418d632aa21ae9ca2d8b0a1fbc77b6aefc229fdbc22672dae3f618339d363fb56a3c2284c34f9a7be796b1c5a49d6b49fcf
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:zQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T1F4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 908a09ca787769259e2724ea906c4d243379d4303600411dc0f60193ca556193
MD5 61754f0b768edd8552229c0ada889ffd
SHA1 38ed6556b63a103cedbe08c483b8cfae87c28a17
SHA512 7e0f49b8e754131fdb66b8339e4ed75ec5b16551dcbb4d296c8a878bf988e4f48f5ee82aca418683952e457037841090a699571c144cd3e40485fef363ed7de2
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL03nQ/tbw/2Mkjy6g:n68Qg55nhheWu7PNU3/2Q/lFTjN4
TLSH
T173B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ffa2db15d2cfa0316e5b2e9bf189fa298173793e8d9d2a11455e6a66b581b03b
MD5 8657200afe85f075ddc77c75a02386fe
SHA1 b2f16b6099f8615923a92911d0f018c23438c874
SHA512 8f9cd621f804cb6bd340d984b07a689f6f15639d320b798fede739aa102171a0caeab13be6ba438192c4e7abd952c487f409a1d7d63414a0a76610e14eebf9b2
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99k:Wy5112gYy5azzVvL69nLKnhZoLm
TLSH
T15C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8eda02ec57bbc65fdda47e214d8e62d9ac4a3c7a3ce37c81b4f745731fc39c55
MD5 326cdc4692fed0b81d1742b718ea697a
SHA1 4e39aebc5187379184daa26a7474893153e9aef0
SHA512 7aae57017b5c5282d9f8b46fabfe361f0dcbcdb9e43f5d8453bf32660a8439b0cbc2de30245441cd7371a460caa8e0dfbf04a65037a295b42e7029b478255a58
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9Q/lFTjN4:eu6JmVxd2dyLm
TLSH
T11BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9cd1a9d8a09d905fda0e55c7a7c8ef4ffc4d2c2041e2d376ac2d69077d741891
MD5 46d36ab023a79a2d682517c402056daa
SHA1 a006b2944575f20c0a989f445f37e7160467108a
SHA512 5de2eb598404e9f88ecdebd2618a04a30038b7c72c91cf57616e731a7b2ffde2959ce288de962be760bf531cf549366c5b538b533dca4923f88a153db1f3e686
SSDEEP 49152:W1hpsNoJpF1A6UU44CwH7R4xsQ/lFTjN4:WmifPbRqLm
TLSH
T119B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6d25a7bea55a8c730f181df30ee2dcf3e5f434c595fc6847b2ca18472a4ed374
MD5 89b39862b6f479df998ae5bffe9798e5
SHA1 274190fd7d50e869e6daf14312c296fcf870dd00
SHA512 553b3aad86e733cbab9f9e4b76ad180d03605c6a2827e81b28cff448a627bde75ae39ade9a19d5a64353bf26a277c93856efaa701eb78e2c7203b0d554fd5484
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqHQ/lFTjN4:L5dKTi61sLm
TLSH
T19FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eae584e3bea2020fdd7b34a6afe26914bd23728dfcdfdfe77856a8b8449a7203
MD5 77c350f475215e053ee1bd1c6b86a9cb
SHA1 5d8ddd6386b9a0fa040a87de59443ee3fa4863ff
SHA512 a33798ad465b9915b2c0e3338858c633a8029f2b21000234ee03a1075de96da3a1ae287d57e677ce094fdaef62150eb98ceb9baf1ebaa244f3d3d58c4b65bd1d
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wQQ/lFTjN4:FX2iyphWLm
TLSH
T17895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fedfe13b00cabd8da9bb6d98e6a1477bf4994f4e1dfdd69eeedc261c1df468c3
MD5 66a6b99db43128b930a504496fe11869
SHA1 289571f01de9fa1fb35c0d413b3d367158e175c5
SHA512 d53971edd99659532a34a71df71a76483c05b0f013300ae56d666ad98157738f72a0eb0903ff4d9425b2f6df6942a6c13f59c462b2418e1007972c6fa8eb06c5
SSDEEP 12288:nLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:n7nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1D35523697965F98BFB1706F18C828182977F0EC2BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f2110a51e48a4264ccf394a58f8808d3751529c5516b80c359845a19c7c01a3b
MD5 54e69fc3232355b12ab3142510f7abde
SHA1 cb104b9eb9c3d5ca62a57aa7f7fe5697859926d4
SHA512 8780a58f69b766b106e49757873dddc6ba71eb72a52af17f693f624dfaa270cc3284675ef933f6f78eb5350be352dc678e16d0ce5a4de0a2eba97a54a9370355
SSDEEP 12288:n6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:n6nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1D85523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 add5d00d8b14791eeb972442799084567fa1d70d8492a9e2e1696581b63c938a
MD5 d3bddaa25c28e2130687db708a8aac8c
SHA1 34678f550b54d3df361b22f89f52b9ae380fa0e4
SHA512 a11ab492e68d881a715b3ed3e909ca21b4950c42f39e6cb5923e90d7d8069f2cc5ba589a80122a331df536142723c74508db96664eed8cf3a2974cbc06b377bb
SSDEEP 12288:mEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:mknQ/tbw/2Mkjy6Fr7g0om
TLSH
T19A5523697965F98BFB1706F1488381829B7B0DC2BFD1A38F7B4C2128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 5c6e2d9477566f34e5d9674a6b38d03913f33562baa93ae95446daa8df826dc8
MD5 9e7e9bebcf39958f23b47e7b1682d01a
SHA1 64d29733370b7bccf1522fcdf2875230f1bad1f0
SHA512 1dc05c50a34b12d68b45f3c086e9cc23aa9a33cf07ee1953f8dae89443db4587d6f1211b123f0c4e508db2fce75efd885ccba15309aa8c230923840560be49d8
SSDEEP 12288:FVlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:FnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1A55523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D41AA9B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ea3f9523a18c0616e9dba98a99e6c7b5e4d8844c458521c9fb4e1b3349adbc36
MD5 a144551c29ee8a4764b0e93664a2c61d
SHA1 338ace7397abf999e99851c07324e777c3bcc7a5
SHA512 d9b95a12522d9463e2a14cff309217f0b580cb61b471bef3a789b86a8a449db0e328ba5d05e68ecd43d2eb43a4730782c43682f3a038bd17cf66290afd1b2471
SSDEEP 12288:RtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:RNnQ/tbw/2Mkjy6Fr7g0od
TLSH
T17A5523697965F98BFB1706F1488381829B3B0DC6BFD1A38F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1b8501381e807a71a3b55421755794c7fc9ae68d33e7ca1adf2eda19cc22af73
MD5 263f5a9ec75b0c9f1089ee4d011547d2
SHA1 7aa3208a01a4a333fe8264cafbef393eb78a4f1e
SHA512 d0378439a4f36e1f80610a7e622c63c556465c05202aaa5a183bde7b7bbea49a43ae82f7ad5886f77e60a12ef5b2db93b12214db715a57a4517507fb30f461bc
SSDEEP 12288:X+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:X+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1735523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c0120b9183eac0505c3e56ec650fab5a18169520439332b6e3810f979e1c70ae
MD5 06f3c65b2662475d793cc020c748911b
SHA1 c83ec382c9963426445929ab6ddf6aa9794e5e0d
SHA512 0611adc4706c322fce9ced75a7db145f867ace06e460b9ed1d4dcbd4623deae2bdac422807693f1a38e27a296ff6681c40ea528f3dc911d3947f54585174e5fb
SSDEEP 12288:JiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:JinQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12D5523797965F98BFB1706F1888281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 909d9e765fe877c5dff283b13620e643f91ce396821be4066059231da30cc90a
MD5 12435c93a48fb22bdf44595a91c0110a
SHA1 6731a8d368c2fc01b5a4272c7aff0e0dcb6f1321
SHA512 95ead01d5d5d3307367d8891af1f7117ffa38e491dc0323d1f27c3abd2cfb3d1b2da6e5113007c85aeccd3c2ad5254b71443f77cacb6eb283f2b5d0c04078ff2
SSDEEP 12288:hiZwbDzzFEoS2cPvyaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:kZM3zFVSOanQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1897501A5B39058F9EC67423ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 65c9893cf8828d17a815f053290b8c05438c54d5d6e562e45c275a552098e83c
MD5 679795cba91bb3a3046056097934653e
SHA1 a06726334b8aac68b42d689ba80b6f0c7993fd90
SHA512 ee8f3e9c38e4f52054dd38dce163d0f1bf9feca2176f873e649b440ed430f1c7521f7b83e487d9a6b06f77b5e1075c1fcbf14fb36422a2e87220d35ce5c036ac
SSDEEP 12288:t3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:tXnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1D15523697965F98BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5c33dc7f70b16a0e331c738c2be668a713ae6dd67c6e2026a65202f14bfdcb31
MD5 1286aa47cfbac46810b427dab5876986
SHA1 4b39612f2ba76f8384e7f1cb4e4cfaba04d4015a
SHA512 b05ef5b5a11c128db740c19f7bedef1a1fc345c0eb8fd8cf977163b8b1bff094670b40cd5f9a937e4a89c9810395f7f7221f2a8af0aa9214a3542dd614127784
SSDEEP 12288:5jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:5TnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1AA5523697965F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 13fa2c38a032c55e1fd4f61c5af5eb48dcc6788160447fedf6c2f94d73386808
MD5 0c8042caf1fd5786086eb9467007b067
SHA1 c0ea7c50d489903ee04a271ba49a1b970915c3e0
SHA512 292e50cf1e6bdf76fd100686997584955259cf488f253239e52597df235b3e9ba3a8cd3ef35d6c6274a5ed7ba6cec404ceac90fa73d74fd02537feb6de3ef5cf
SSDEEP 12288:ByPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:QzyWnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1FC65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 91e4e27a1dd0b81d1d8292caabfd85942c14131248585f923f35bf4b367ec5e2
MD5 62fe15c24a41e89e5db525dd491a0c80
SHA1 ba5f1223da24724db5fdbc8d1b2d3e275fb95dbb
SHA512 bc7d2f8b8e3e36338345263697ef54139560d1fe80221ca0ddd7133743962286923c603c9598a6986ba858f002e8b46835f7c40e186c94a90f329b9b4eb90826
SSDEEP 12288:93GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:9XnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1865523697964F98BFB1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7f18a387dede8513d8e56144559ff5502232d2a9d89020363874b04f647de800
MD5 290e07f1bc874e3295c56a9f5a756f98
SHA1 994b42745f88c2774113630166ac4023393ea747
SHA512 99b21000703febfafd26900314cbd05cf336317605cedbed1610c7521e443482d4ae32b959bdca409ca0df23cc3ed9a70444a4f1ead99f9f1712862c880be42b
SSDEEP 12288:l3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:lXnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1D15523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 31ac856509d8abb8e0e17976b96cce14036479b976b85127940b2cbb339b4b20
MD5 3a88c9a11b8bd297c9c28d9fc40c75f9
SHA1 617a8f3a09bcefea2162f2227741f9327b8532eb
SHA512 b1a93d842dda1c9cc05371ff83376f1a133c18e813ce7dbd6c19a243ee5d274b33002c7606c793ffd2b296a0277ed36444a79f769df6a029db2d6e7466271994
SSDEEP 12288:2yPz5L82GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:LzyWnQ/tbw/2Mkjy6Fr7g0or
TLSH
T19A65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ce7346a2374981a493584c11c67c2144e8ed850d5460504bc0c8e6dad7a9e211
MD5 c2b2ee48dd7322ec0b8b731a93785da2
SHA1 f71af773d6b73e4694f8e2509885d163e74c5b87
SHA512 dde4ebeefffb74b4336c3bf034d99cf995e8074c2d02bb5c36e59e8353abac1b4ce93c72197bc2f34d786d98008dcfd0beb5da993d10972e372e1b70b0e441cf
SSDEEP 12288:1ssfnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:VHnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T11365F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f405a3df9d7345b09e403c92c8c96d0c97c4633e7afedf79a09745d18e2032d7
MD5 9f82ed8fd1ce8710999eb61bdaaab3ab
SHA1 460f829cdbbd9d5563c01f08255ceb9a84316674
SHA512 6c7b6e5dc8ea408cc35f70160f88aa9c33e0735e41f284304a7caf31cc94e959a55e98f0f3a7add22ebbdcc0d07fd8c2c40fddce3b87e5407ba0cd171fbe353d
SSDEEP 12288:WNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:WtnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1AB5523696658F94BFA3B06B048938111673F0EC5BF91D3CFBB042269953C3D41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 15cd4cc7ca04085bb1641e706a548df787e800deac650cc452735fcdfd0aae0d
MD5 760aeee35eec5b58a8afbc839b6b1e9c
SHA1 231efa8faffb093ead8eb8a2b720f8870308108a
SHA512 9999cd6c4c7d6f00016a09a9ecc685eb688bccab7253b1a35678500d036e32b850319d75c933b6f25bab1182db6dd90a4a414843e9baf729eceb962ab497f7b1
SSDEEP 24576:C8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCTnQ/tbw/2Mkjy6Fr7g0oR:jRZwQCyiHiQEaaPnMOQ/lFTjN4
TLSH
T1E785BF1E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a2072009b9f9a6f501e66342f7fb5737c21262bf81140f2805f3b0175df2ac00
MD5 fe613244e7f0c72255f5561141649016
SHA1 af7dfa5a742c4ed41f0522dc89f9718498a8c462
SHA512 580707522dbd6102acc5ca6b0d89d41fadb1f3a1e61ffaea39a0c3677253be0236a1dc606b39e3b90774b237d4651500840c4d453a740cddf533c868f5e85ece
SSDEEP 12288:gbxA1U7KRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:gbxA1UGhnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T18555123E26AC24E6F636917D88D28106D3327C56676193DF2684823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 8f2d44fd71ee5ad76637b8416023ee8f3f4f8945a750f4171b5dfde50a36bd75
MD5 64cd808c1abaff41c5a416edb8ed7a22
SHA1 c3b51e959b934d03145017376174bbebc815b482
SHA512 247dcd2f3ff3de4e4afd12308c9006dbceedeb61c3a7b9e09fdd75bddfc795c6ca0bf2078e7938c8962f5fe565802186cff98f2ab4341b6982cd68006493a32a
SSDEEP 24576:BjsmP0yHaqrVqHra44KDzMsrnUnQ/tbw/2Mkjy6Fr7g0oH:BjRP0yHfVqzlAsrnUQ/lFTjN4
TLSH
T1DB45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8a23654fe23a41643ee7fc358f8445273dcefb70a92368413fa30f692a3be835
MD5 f3af9c7ade1ceb6f55433787fc0618d0
SHA1 a209c8322e86b99ee7ad8da7ea1255aade631023
SHA512 a9c7caff26c2f3d76b1856bd03f07647dfd492019762b5b51f72bc80814f97212c2b0fa634f3d8ba0beffa33fcd1ebd2826e9050651b80700d3968b102f8ec2e
SSDEEP 12288:RbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:RLnQ/tbw/2Mkjy6Fr7g0os
TLSH
T15A5523697655F98BFA2B06F548828142673B0EC17F9593CF7B482229867D3D40AFB780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 cf458845b41915769ca07204e09fba1bff7955b538966e01b6fe683d6c3f76f8
MD5 146653b24da4546d176500f3e4b74fea
SHA1 9dc0ecdcb1366fe1210bf6675aa9e07e492ef998
SHA512 0bb7c483ea3ddeb68b53204dcdfc7a4a2ba4ab506da2da577f50af720cc63f6ff023b0b7e2f29fac065b33492fe0e97508dae5e31075b2f765c726953a67f13f
SSDEEP 12288:XOb4A4LWO+vAYFTxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:4wLBUTBnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T18375F155F7A450F9E92B813CC8A28616E772789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cfaa3d0a1bc3bcf489cac35b4f4e27ec6691b0684edb3562a08fd6c8243cc225
MD5 1092b0527d40f518935a14a7897e8c05
SHA1 6cb4f549d252d1277022d64696a635b5bdf846a5
SHA512 455cecca241cc2ce9946bdc8f04bcc81da7c0b7ff3aa8d915aad4fb32f27ec79c25db79718306fa77450a98c08e36ebd7eb6caa4e66f4327f4d65585b9b974f6
SSDEEP 12288:L70VmuIYNvUyBpCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:0KYNHknQ/tbw/2Mkjy6Fr7g0oS
TLSH
T14565F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ef4ae1d462182d8f7abf3b5efef27d905c4886149d5ed0fa8e394fd1dbc00df3
MD5 7a42060cbca4308769963005fb55964d
SHA1 0b9fe0fe93ea368ee5ec7249c421b86b023ae2e7
SHA512 89df23a43435346092f81f6d34d1f11851b65b89460777d7a4dea3520771d2e079590de117816f1d855c8b4df04420796d54960ac91cebf26dbcb7c08fa60530
SSDEEP 24576:3nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKU:3nXoJJYH84VVS6AmEcJas+cHBjSSKHPn
TLSH
T1C065BF6EA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f45725e75ace5d7c72ef1ba4a38d31e88099923ba5474349d288b644af0ba711
MD5 75149966cdadee2d6d223e3e4113b1db
SHA1 05592af98a6052dd927529e026ae20c780d39dbd
SHA512 d9293e7ffbac2f1a9afff1748e9e6d128745e2bb5481b02faaeaf2e561e0467afc7193ce6076b5ed99e2b37bca219bb5602131c0b345b5d3e8e1efa3981ac5ce
SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSuxwr2PCanQ/tbw/2Mkjy6Fr7g0ov:kDLL9TuJ0M/TYW2PrQ/lFTjN4
TLSH
T1CA858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 30d8e1d3aff586bf9f2e95fa51640093df550da84111e61fc5b69dd4d7cf6852
MD5 ec69c33ca61e369229c912d00bdb453a
SHA1 73afa0c69d50abceb5a35e9f9ffbc9dbc2a4eeb6
SHA512 818dd49405d864c91d4038e23df8715e602818a4f7de12de0bea5e7db5087935324dee8d43d50ce5314cd71c0d123d5966a236f2752f6750d783d5db9b9bdab9
SSDEEP 24576:/egJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wBnQ/tbw/2Mkjy6Fr7g0oC:/ngOJOmPOHhBQ/lFTjN4
TLSH
T14C55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 65a52abd78c0b5e85f22f3204d4093cba0025a8e6e96cc6a9047828545af1cad
MD5 a62b18a4e21bdd9e05b593b549e1d439
SHA1 ff3b1539ce9b9ff004bd8beba9204a1bca1adee2
SHA512 e0eb58beca8f7a51ed5bc2c13bd9f8e6595fdc463dfaa98662b2d28c8b99ffab02fa919b53d5da15ad99e9f80e4b251acedf0fdeb3c69372eeba75b23a38a592
SSDEEP 24576:PLJnJiTk3R3waE4JrOrnQ/tbw/2Mkjy6Fr7g0oh:PLJnJK8R304lQQ/lFTjN4
TLSH
T16975D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FE06A79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 20d74a356da93826a30a2922d00b83f9d1f3dd09f178c7fb104c39f8fd442b1a
MD5 593e32cbe75e90cd92259c5a18222af1
SHA1 0df556c0d80d4bb239ab7f671dc748883ac18758
SHA512 3df2e44cce67df7d5dc5c2433776eced55ba7ae4f201a7a010a3bfb7c0714b36bba1ede992e3c1ac758d46b39bb86fe4f66bf25754818b7260953040a262f7b4
SSDEEP 24576:PA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p5nQ/tbw/2Mkjy6Fr7g0o1:Y9GqCzDScAZmlvTcFg8Ph6nQ/lFTjN4
TLSH
T16B955C15F7EA5298E8B3CAF1C96294159B337C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 23343a1fc55e919deeb1406fa635bbfbf8e353df73ba75ce2b0829144d76a43d
MD5 4a33c05548affa934232f321a59abfad
SHA1 423591d221522a09fa3d8157a426600e712fb30e
SHA512 8f69089b1aeea68974d1565abdb898614b78ed600fde74b808946962b27b6cfb0f2002adad7af02a4861a09b14b3a579653d44fff6f620e7819425e7123c3409
SSDEEP 24576:elYJeXm5jUuEdnQ/tbw/2Mkjy6Fr7g0oj:elYJeXmRUuEdQ/lFTjN4
TLSH
T1AB55126D366CB0E6E22F41B988928545E372B4A1274163EF52D0C27D8F7B7E51E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 6b522e1b4241b8631612b67a7244c2eccf650eeda61eb15424032adc545b67f8
MD5 07ea58117d5cb373e737f29b928ae9f9
SHA1 c9af81166decd1a383b6cf5754429b4bccfc1a06
SHA512 ecb578b8542b456853d9f7b6723664757a0effc687af3d789822daff9e98e2b9c7dfc0cf246314ba20dcf3b52f73450a48ccc02cdf7a3ab453f50044dfbd4f7c
SSDEEP 12288:TFu6kygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:TUtyAnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T18A65121833A4B499FA7A06788DA381819F3A7C50AF5093DF66C0E23E5F3A3D46975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 c0c5d7152f0d9bffc818e55083a19b11269c95aa18670b6fef10d63573650ebd
MD5 a75af12dc67499cc4cb1865c35c409e4
SHA1 44063b7e93136b9d1d7b6b7802de819e9e1a2228
SHA512 4b1e63a97dd076877bdf2790738d38c24e0b38bb488301f34fb716657222771982354e052f86eb986486d27ac39923e623989715a167c3767072bea4334ddf81
SSDEEP 12288:yPxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:+BnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D955236C2624F49BFE2706F448924142A77B1ED17F91A3EF3684A139CB7D3D016B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 5cb125e4f15f1f78b1e720a6397f69da2dfc7977c45a7c06ac652fbb7fcd4efb
MD5 50312b3e49d91ae26afb8fc4e4bc67bb
SHA1 824e844e1268e499c7d624859c88645358e87ef8
SHA512 cb5359fa915e10b736b402e22add3db86a6b65bb475ae27c7e0846d22e3af652cdc33edf7c9f8ed308a2c902ed065f6ea046fab2dc7d421cfe5680fb615c6fb8
SSDEEP 24576:CC+TyQIu93VAumZr7jmmnQ/tbw/2Mkjy6Fr7g0oI:C/TfIq+YmQ/lFTjN4
TLSH
T1EF558C1DA7E91DCAE276C675C8A34493E633B872177186CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 dc8f63c6b3ad3168779a418f3dbe9d62384dfe2357c6e05900082e484334b1da
MD5 d96a7e07b14c19c26439efdbb5472bfc
SHA1 404d652db7770481132a67f8b95175fa5ec86f3a
SHA512 fa1a48cf1aff79db08c7c908e3342f6f21d47bf81fd2f206929e0a25b35923cd9745cdf83ef8619f07d0e7c0997aa5c80f37b510390edca109287055b9760d16
SSDEEP 12288:acyrWOstaa3kcsFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:7LQikZlnQ/tbw/2Mkjy6Fr7g0on
TLSH
T19E65F11FB3AA10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 55da36ce78f241c49fbd8533b34d7e1da8cfaca08a175269f51fd20d72986d72
MD5 d90ed6e79bd7d3fee5c217ce55e9f948
SHA1 b57695a487ba043d5ab1db55defd36b277858734
SHA512 10ada83c8051a12f9b473f0f21f9e2834cd5f2640af27fce532a1d18a02d938f80d4c7070b558b690850c5a03d57680648f54cae2d67bb42f7dc14bda1037549
SSDEEP 49152:ApJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPAQ/lFTjN4:xpC7b4+80GTkkLm
TLSH
T1CEA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 78e412d92fd599686ceedfcda3a7c55b00c1f9aaaa7ff442d56d234b3758af13
MD5 4f2f04cf45e93549138f4fb4bd02427a
SHA1 ff701e636278b89699c72898b99f10c54226e679
SHA512 8bafbbe13547d651352ea999c85bd7705accc8b81e8d42c2ee263ab61303af174fd08591211c26831869d27a02fbfb41c1eee282d2afc4ca3bc0ad837f4e50a0
SSDEEP 24576:ASAwJPE1IDAo+4Kt+l44135UQcnQ/tbw/2Mkjy6Fr7g0oy:AqPCIo4Kol4/QcQ/lFTjN4
TLSH
T1F355B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-317-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/568-427-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/876-444-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-450-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-437-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-438-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-459-0x000002811D920000-0x000002811DBA4000-memory.dmp

Download

memory/876-445-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-446-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-436-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-441-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-440-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-442-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-439-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-443-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-448-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-447-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-451-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/876-449-0x000002811D910000-0x000002811D920000-memory.dmp

Download

memory/1112-428-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1112-327-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1168-76-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1168-72-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1168-90-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1168-87-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1168-66-0x0000000001640000-0x00000000016A0000-memory.dmp

Download

memory/1192-244-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1192-89-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1192-85-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1192-79-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1204-431-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1204-339-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/1416-293-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1416-423-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1416-299-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1416-301-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/1864-426-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1864-311-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1864-305-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1864-312-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1904-252-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/1904-321-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/2204-215-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2204-18-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2468-77-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2468-33-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2524-430-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2524-336-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2624-338-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2624-283-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/2896-290-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/2896-420-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/3544-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3544-243-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3544-54-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3544-48-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3668-429-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3668-332-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3780-260-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3780-266-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3780-256-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/3780-326-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/4232-331-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4232-280-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4232-460-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4232-330-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4232-435-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4232-279-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4232-272-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4232-277-0x0000000000820000-0x0000000000886000-memory.dmp

Download

memory/4232-425-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4440-5-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4440-11-0x0000000002BD0000-0x0000000002C36000-memory.dmp

Download

memory/4440-63-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/4440-12-0x0000000002BD0000-0x0000000002C36000-memory.dmp

Download

memory/4440-0-0x0000000000400000-0x000000000055B000-memory.dmp

Download

memory/4440-64-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4588-386-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4588-349-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4588-352-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-402-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4588-455-0x000000000BD00000-0x000000000BD08000-memory.dmp

Download

memory/4588-418-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/4588-432-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-452-0x000000000BD10000-0x000000000BD18000-memory.dmp

Download

memory/4588-453-0x000000000BD00000-0x000000000BD01000-memory.dmp

Download

memory/4588-343-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4608-38-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4608-43-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4608-44-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4608-242-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4956-351-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4956-424-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4956-287-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4968-324-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4968-322-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5024-27-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5024-30-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/5024-21-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5024-217-0x0000000140000000-0x0000000140155000-memory.dmp

Download