3204081281049297f3f7338cc4001910e6b4006e297d1c7212b3825401faa406

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.9MB
Sample260523-lpfldshy71
SHA256 3204081281049297f3f7338cc4001910e6b4006e297d1c7212b3825401faa406
MD5 450f24405c4bf4be1fe80bc8f9d63730
SHA1 7696b826bd25b78439d36e0f5ce6c07e60951a77
SHA512 ab67d6fbc44451762c4047db6817d405a1bb83a90e5eafeb115422c9c83fa9fb7f94fdf42fd4d1c6cf144a4b63c9f58167fdce8261e02fbeab216b6ede88db4a
SSDEEP 24576:fpCQmbANrr5MiwFhDoET9lyxknw4FYnshx8OfVe247:fVmbANr92TDoET9wx4x8EVep
TLSH
T17495D0307EF48035D4F351B446AD622151B9FCB01B3981CBB39453AEBAB0BD1AA35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2908	alg.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
2244	fxssvc.exe
4888	elevation_service.exe
1100	elevation_service.exe
5620	maintenanceservice.exe
1868	msdtc.exe
4156	OSE.EXE
2600	PerceptionSimulationService.exe
2196	perfhost.exe
5588	locator.exe
5004	SensorDataService.exe
6096	snmptrap.exe
5680	spectrum.exe
1724	ssh-agent.exe
1856	TieringEngineService.exe
5288	AgentService.exe
5580	vds.exe
6108	vssvc.exe
3164	wbengine.exe
2824	WmiApSrv.exe
4772	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\26946a45ee2c9d24.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006615358198eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb96528098eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1e7b8098eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c0a878098eadc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a95718098eadc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f1e7b8098eadc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
5016	DiagnosticsHub.StandardCollector.Service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe
4888	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2888	2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	2244	fxssvc.exe
Token: SeRestorePrivilege	1856	TieringEngineService.exe
Token: SeManageVolumePrivilege	1856	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5288	AgentService.exe
Token: SeBackupPrivilege	6108	vssvc.exe
Token: SeRestorePrivilege	6108	vssvc.exe
Token: SeAuditPrivilege	6108	vssvc.exe
Token: SeBackupPrivilege	3164	wbengine.exe
Token: SeRestorePrivilege	3164	wbengine.exe
Token: SeSecurityPrivilege	3164	wbengine.exe
Token: 33	4772	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4772	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4772	SearchIndexer.exe
Token: SeDebugPrivilege	5016	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4888	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5144	4772	SearchIndexer.exe	105
PID 4772 wrote to memory of 5472	4772	SearchIndexer.exe	106
PID 4772 wrote to memory of 3456	4772	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_450f24405c4bf4be1fe80bc8f9d63730_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:5052

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5620

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1868

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5004

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6096

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:648

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5288

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5144
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2724 2748 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5472
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2916 2912 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 43d0ee95fa0ac8776fe9d7f1ba456a350034601cb01cdeccee677788dab1aa9d
MD5 cffa9cb1953925605114de63ba25f05b
SHA1 ad70d5318217e929b78392f66cab1d73262a6c5f
SHA512 b16270a784c9d5969b7a2afff21d5690713ea98673eb9ce77665f1d1040cc775b3c379578f448d776a124e4439ba9a97639025291b64bae6ce0605741f86eb5b
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn1x4x8EVep:g3q6HjBaix8EVy
TLSH
T1B9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 194c442d600d52da7debac79ee9ad0885f583ea5c9edfeb11af91ea4cad09559
MD5 128ed42bd15a8d0d881d99103c49209c
SHA1 6b20e801c7c96a874b9c478c364085e090d0e14a
SHA512 2b29430d2f4ffb79d72cfb84ddf3c90639e6b12cdedc1e8542d3de3853d274ea3514cc4b9e2d507a8369863d7e0ccd58c827bbae50a17b76c06bcff4d10b8e4e
SSDEEP 12288:z1XLsswWkxy2lRq2czAD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:pXYfDtczADyxknw4FYnshx8OfVe247
TLSH
T1AE75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 e1e59c5820b3f0ce60e7dc21f88a020200544aa04ec346ea2431c06919d3db22
MD5 f82a2ca8b908d02a1351507b56d3f7d5
SHA1 28e3509d7a4db255429cfc589a165f24ad5cc4cb
SHA512 4943b350b430f92ec94330924640b97230daf29d3cffe6e35dcf3e1153070aaa1b8aa467450d903c230c6ba2806b84ae82f0e183b92ccae2e8bee517432a1ce1
SSDEEP 24576:E0Le5ji0hmxFrMyyxknw4FYnshx8OfVe247:EPji0Arcx4x8EVep
TLSH
T1B495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4cc5c81e815861292d521b3f3ecfe6b0a3c0b85fc4d7954e0fb307e75ef48b08
MD5 49a3e5ed654522619a6d88f1c5e27cd0
SHA1 f412d862f5c3c186205bedd8e217d2b8b87fe7a6
SHA512 81930deb5f1fdad55e7d5742f16657e0c308f8cabcb3eba73b74e7bfa2592380ca0b0b04034256a2d210fc2132863508e14e0aa99c96d8ea2936844d6a1cb215
SSDEEP 24576:8a7/ezSC6vUyD/aqgrvWE6q8wyukyxknw4FYnshx8OfVe247:b/ezSC6vUzPvxHjyYx4x8EVep
TLSH
T1EB756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 72762e9632f81f346a48750bb41eef256805f15a12bd3e2a75f8e780153998d0
MD5 7ff3c5db5fa862a9a3de5e7f8cf77149
SHA1 5d7b196bc6d13b4fd4a03606d824104e15034ce1
SHA512 8826a479be8e80646bed8bb8991d7cbd9673420babcf2fa1fd0a43b53ece0e2e36400af5e985b5931aa29419a1cf9ca1ec114f64808b88061b75d095edc44c78
SSDEEP 24576:iVbqPb88hv/l+6fyxknw4FYnshx8OfVe247:iVO88hXl+5x4x8EVep
TLSH
T13A559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 12a14eac893e7cff93cbedda7a43f76dbdae5d98ebcbd5c1e2749ba2f230d879
MD5 729d5f7197157e1ae0505f00df65ece0
SHA1 896aa00a3792cbb4a21aba0fe413ba6b9a816b0e
SHA512 b8c52682bbf97c72bd0ab27d32ef5473320dba6df8a313dda9735debfc9b498c47c3d91ab3e1455cfb28254a92640dac7200583f291c42a236535ef4b390d4e4
SSDEEP 12288:TNO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:TNOyxknw4FYnshx8OfVe247
TLSH
T1F665237CA7DDA4E1FA5E15331B7172623616B9A4DA74C11BCB79B14EE0F0C60E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 10cd3d3fc62e71d3b035605b3ad11ee5bddf9f78362087952f96503679a09872
MD5 58e6e46c942fee2b28199008f71b7bcd
SHA1 cc1880207b75ccde3efd64ec8cc1477579b27f4a
SHA512 6338b383c93d6b13cdf2742eb4953d2076c17330ffb34d84a675516076eb480735d5b7d0bce0c71fcd86063591a7d7208293efc25ff7dbca008e662edf0814d0
SSDEEP 12288:4eBNUbTVO86UX+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:4JIUXyxknw4FYnshx8OfVe247
TLSH
T1CD75CF7BEE28FCD2C27E5DB95B918200A76274704F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 27e954911ca421a6bd6b9b4525f791d006c857f6b5ed15a6f5c81a70daa29bbc
MD5 86d2d27c835a86f855205546338a1a32
SHA1 45780161c6c121a0ae955e825662603323fc221e
SHA512 a72c658fc8f1e5fedc968e4c1e4bb0a706cbc657fb23bc0606412067f437ab320fbf0bb2c992463a5ff50e0003ffe192fba35dee0e459790c4f72035318638ca
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:qQvGAdlCEL8c/yRNw5Cvix8EVy
TLSH
T119267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 a466edd2508302a25db701e0c2814a8c17c7bfa5defd4f49f3031a01be35ae12
MD5 9ad13e99db954e4369a32ff04b5ffef6
SHA1 9fae91fb503ba039af09d1cd8bca662524354833
SHA512 2f8c0663f0c6868b20fcd9bd342bdc570643db9312ef150ac9e5fd4a098513bce49baa77c397fd46bec162fe47e4bc9e42711cd586df9df092c33269471c7e62
SSDEEP 12288:xAwSfxL/2Dc3LDLLmt0LDQewsAjJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:S6ewsAjJyxknw4FYnshx8OfVe247
TLSH
T1E685E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2b6cbd7d8629bf73c1fb442e56a497c76ddd49cb7ee7e87c89560a460c25a463
MD5 80ab594b0ff5c637d80980f887cb06c1
SHA1 e25214cd7d711a6486272144a7c7893f1685e96c
SHA512 3cbbcb9e0899621a0a4313479b868c52b7a445ce70c4b582a2443e0739ba4d4f803bf7570145accc616756ae4f060814bbe21ad28ea5fb922604ef3d28966b82
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJ:aUEtQevvqc2W1cpV2EI32
TLSH
T1B1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6de49eb39e72d52b7092fce0a085101a8b1f13a110a34ca10f52a1dccff11cd5
MD5 71723d64823c1c8d3ed3bada49fb8c12
SHA1 7611e888a3fda8cb98828b8fa7c34c99b3c22609
SHA512 099bf840af1d701a2a0d162a50b0d6d0efb1a939f2b747285762e88a389906707478d64be43f4d1cc6920205500045b8f7e32596a4ecbf2950cb548564c28809
SSDEEP 49152:PCbRquA/m2yL5zQfFiV+XenmE3/zsx4x8EVep:IoqtVjnmbix8EVy
TLSH
T16CD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 13da3794532aca80f31b017e4a63dbf323589638ffc294f617af05bcddcf1081
MD5 323f3fd7984306fe9684e85fe1f036d8
SHA1 517840224514b028985fa54521dea473005318db
SHA512 91b706985009fd0d3fc7f2b16fa099eed204a8aa6871f30d87da61d3038f5b6b6a972247ec22de9dc56ce33ae873f2b222d18daa219856fed953de331d3e700e
SSDEEP 24576:wAhGLJIFoiwtA5l7S53Yyxknw4FYnshx8OfVe247:wAMyFoiq5Lx4x8EVep
TLSH
T14135AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 c041a433c1cc518ed0884d04fbe175856fda170f5d212375c9275bea0a9f37d4
MD5 c56595dc7b227e0ed250c752cfcfe366
SHA1 ccb9e9534dae107845e70436db894420f1afb1d1
SHA512 f2705949074b6e7714632629fce1ffeb9d27c2c33da3cea447473f8e66d82dc8aa06959ba7b44b8ad4e24efad4b27ffec72c82b4e5487b4660099e00da47385c
SSDEEP 12288:gmw5HEjsChNoBFgl0WDm+CE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:9wuFOWNyxknw4FYnshx8OfVe247
TLSH
T19C75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 16cb28ddb29d4463337672d40628474b96574d03ac39da479f259b9105d14f07
MD5 08cf64b946fba8104b85a14c2ce8fa0f
SHA1 e21e2a1c25e836b4d917521136d19dda2cf84e10
SHA512 c19f7f197f44216b1166ebd71b812c192419b65e5c9bf28fdb4fd490f7f6887d576565434547eb19bca517c0687bf962904fe0a28eebfe9bffca3e2919e0dee0
SSDEEP 12288:cFZ1Iy5+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+ZuKyxknw4FYnshx8OfVe247
TLSH
T1856512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5a39bb4f56198976de60c584cdb811af9fb372fb48639e4b28f39a166a60d83e
MD5 5b88c33f4a4e3062293b8866851206cb
SHA1 872d404597f0958c6c59bf9bfb9d29d354b646ce
SHA512 e086a43ece1493df3d8e102001d47db0758a7c3bf49b87c87a01085d57bc4cedee8f4e1448952200b23fba878e558aedc743644304c37103568ce88ca2a43e54
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:MQRQyi36YOcPQLvw2gAf+PN3eix8EVy
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 629bdb578ea6ca9ccdaef1a5e4c5c6045c920e282fd0af92946813c67dcd9371
MD5 a68e9062d375ac9e63963837110a6dcf
SHA1 62625f83c59634242a4496abb526462873e9027f
SHA512 cc520c1d98d0f799af61c9c48588b8bfb3fed530a56d475fe12b48d8e0c19e419383163f532fed1cb7c35590c46aa33df4ef6847d39066f0af6d0856757146e0
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UM:sQRQyi36YOcPQLvw2gAf+PN3eix8EVy
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4c9623b01c7d2d425646aeecad727c51aed1b102aca8b12d9e0dc53f6f007793
MD5 9af94a8f82a22c03bf675578914d5a85
SHA1 9ab054a75176b2eca1022f03585b47e610e8b770
SHA512 54f5c0d33b5a1e226b1973b39ccb5070ab94a31df12ebbbf0373c76e1ffed2c94fb3072ac5bc55ea7104afb2bd0881509091945024dd65f5868b02d51411ffc3
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0ayxknw4FYnshx8Z:C68Qg55nhheWu7PNU3/cx4x8EVep
TLSH
T153B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ea1b8c8297d99e57b50864061f6833ced21c32277ce62d48db55807a18a90e1a
MD5 8566b6eeb2b582fe4bac350e880c33d8
SHA1 0d6f32578d147c7a2c5886d46880b2f364822329
SHA512 e4e9a40801716c9a7a3f3840f894fcc2ea8d98a9f58117ec855aada31164e7e5c5a11377db18d217a156d3418940f809a8435833a9f83438d17969f2049e6d84
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:8y5112gYy5azzVvL69nLKnhZBix8EVy
TLSH
T15A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e4d070719378097e7b6fb45c7808b3f79b83405c2716d552f1f26e27d2a91a0e
MD5 c18b9bb380039a94f6cca438eeccf33a
SHA1 3b256b7cdb38b6af1354564f191654eaf31c9395
SHA512 5c7a1b1493a5503fd3fd71f0977375425d96f1070e2bfab4a21ba18b06d432e18ccef7240f3b6e8be146c438b1be37e1e7f0ea82847cd608d0da184fc7be2db0
SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glWx4x8EVep:Tu6JmVxd2dWix8EVy
TLSH
T1F5D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1c7eb4721a3d946699dc1c11ab19d9e8a518387632b362b5bef8475b84278d99
MD5 693b1eb7cab4ed26a5e9b6653929aefd
SHA1 5d1116e40f9f603db0e5a8b88671500c370c2d7d
SHA512 1de7c7e2614cdc60c9ab278816fe336bff4b1104d80ced90651154248a502e03a593122821d16dbf31da58369f36ed69556a69d2312abc91f8d5d66a571dc176
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xCx4x8EVep:QmifPbRbix8EVy
TLSH
T193B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f61c84ace0342c8abe8a6293e75a27da5187bd1100e4a77b8752b2456bfc0997
MD5 9677667e144b4f1e6915030634aa7480
SHA1 339f56426aa1aaa7ee5ed68e5933a43ad1f56e3a
SHA512 40e06e252bebf5c9252392bdba118001edce3a1b38cfd50e277aed643275c98b31e29d1553118fde0348074663948771b56ab1b94359f70cbace532df16cc89a
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqlx4x8EVep:A5dKTi61lix8EVy
TLSH
T190C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 49863606a6215a7f6f3a860a9c44ba93e4a994d4c2d2a0f94db6ef2cbd5811de
MD5 2acea6dbfbdf969eb324f9bb28765044
SHA1 c11e382cc12d23cbd3b0ab877aa2ccf06ddd0719
SHA512 dd6189ae7456a5946b581e8c3e1590d787223e324f0490df287396a9fc14bfd3249a5b4453bd64df8b8a562f8e504ee3c04dd8a5be850f9f6a350bc08ec5c18e
SSDEEP 49152:khtSn8EApI0figngiDn0AP5wGx4x8EVep:lX2iyph3ix8EVy
TLSH
T10795BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2a847a9d42f23e2e6318c3e2a2d7fa615c7e236005c94bb3f2f1f3cd949ff6a4
MD5 345658d2ff3e03182fa4eb63b965b1ca
SHA1 d027dc8394810113df00bd1a05af5cb9ead03cdc
SHA512 5b129e07334164c7181e6d36a5885c9e2d65e4ea004450d7d655ac23de839a595c88ecebe207e90cc1b87d6e7ee4e86891984bf475806354d66477c7f42402ae
SSDEEP 12288:3G+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3Gyxknw4FYnshx8OfVe247
TLSH
T11065237CBBDEA5E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ae6c918c4cba6ae73493190b23624335c904810abc6dfd3239a968d17297bc0e
MD5 3c066d460490ffc1771eefc5cdc28119
SHA1 458089c50dc482c3d2d221c3baffa2df0f6e75bf
SHA512 92086b6cba27db468a262c71b2c8b5159e186d23837cb2e4076b0fd7bb59f8f79468f55db4b55f3e9ef9c9db0d8fb6d36d2fe85697376305f5332ac05f9be716
SSDEEP 12288:H1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:H1yxknw4FYnshx8OfVe247
TLSH
T1D66523BCBBDE95E2E50D11734B7162626609B5A5EB71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 e2d13e0ababf36eb226a298f35bb2c68ba03098ecd11a3b903cf6e1621018f4f
MD5 16b8b32651bab74389a8cb8509f78614
SHA1 5d4551449bf41aa37cee5e97a0450d8849042b8a
SHA512 f90e3e5367b4c098e77df50fba6ccab905a660bf11d7721a375d2bb6a04bc3e9e07dc2d4b89717ef9e511c831d2e3dde855c47c9ec46ed5164a5fcaf3d3f28c8
SSDEEP 12288:Ev+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Evyxknw4FYnshx8OfVe247
TLSH
T1F865237CBBDEA5D2F54D11734B7263626609B1A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 0743f87ea7cde4905c0e8fa60109565d7b05545fed2d5083a98193fc2d5a33d3
MD5 fa8600ff12518fd7bd8785ca2e126fd9
SHA1 0fd1a1585f7b2f1c88e34ab654d21201a8710e31
SHA512 9ad0cb91178d601a5070664ff5d3292c3c5f41abafe0082664277c17ff231eeeb1117762ba408d2dbfa8634f9b062a3b062c1bf96259e19258fc373606e7f270
SSDEEP 12288:kV4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Lyxknw4FYnshx8OfVe247
TLSH
T16165237C77DE50D1E85A51738A726222B365B8E5E731C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 f377dd354511d251a11e1f622a53b7c6efb958e20c4bcaca2961f00ec647e037
MD5 b55d2c3fe27ba4a9486018a4cd8c233e
SHA1 67af23a0c78c9ebb47b58768aef1690b721b1ed3
SHA512 78dc114598bf49ff1a21f24dd6a2f436f4052424d128a6761726f9900feeb81e54b8a0760df4e10ee6d56928d22cc75f3c5a3e95c0570e3dc3a0f8f1ad3dc530
SSDEEP 12288:Fg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Fgyxknw4FYnshx8OfVe247
TLSH
T19965237CBBDEA5D2F50D11734B7263626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 989b093216780d809f52b8473781db426cdf8dc9942d118586b875070a0d74e5
MD5 5f2c7e97be7d9e489fcf9185a934fb50
SHA1 ea83564a47d0babb393579050c9a41d83c4cc96d
SHA512 670122bb70f3c838189ef64debcd917fc72ba348e9663071949dde17c5798b564e19c1362afcc7daeab192f264949d08b9bf08a420d13f5d7cca389861a24687
SSDEEP 12288:6h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6hyxknw4FYnshx8OfVe247
TLSH
T18A6523BCBBDE95E2F50D11734B7162626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3d0a0b26232b285006926f43415948b16b92cf0a58a2dc1c64f71ae49c82f548
MD5 750b636e185d5495f6b1f925c64b8324
SHA1 7d68e1afd3e430b79353df729840e169c85478ed
SHA512 c26b552f0c4623cd17e030eb8ea3c245765ae93afc0fc736ce02d1bb35e3d6fd45ee2322ae92678aa3899ace5d718506ccd0fda401d74b703ae842b4277d3a97
SSDEEP 12288:Id+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Idyxknw4FYnshx8OfVe247
TLSH
T17165237CBBDE95E2F50D11734B7172626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4418d33e43eeffd766af2a21eb8e3739341a640ca550eab111172eb6832e29d3
MD5 2ef6fa7f48d35b5190c6ca70a531864a
SHA1 e430b49b28d2cccac3975d1bc4d45821a1c4817d
SHA512 19ed80c6fb60e352c69efc6b00741176536258a166c3afd75718155d803fe8bbd3d647d5caf1953b3e083e9306351e3c812278adf3e031ca27480d5a92a3955c
SSDEEP 12288:RiZwbZzzFEoS2cPvyV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:UZMdzFVSOVyxknw4FYnshx8OfVe247
TLSH
T1B37502A8B39018F4EC67413EC9259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 7d2b4aaf64f545c160d9e008e14efe6ad39c4490734b08fded26774a175ae260
MD5 914b7bcbf9d273118fb263eb15a02d6a
SHA1 98dc2199a9e1a028bb6de2acaa31ab9ac7bc55e5
SHA512 e273c076f8c7bad2a5c120238e6e9bc23ef5f020cfe9443cfcf7eb8fff6ecea4a099babfdc98ce562ae538a7e61521355d678c235bb0dcfca0179a1f49d1db59
SSDEEP 12288:c6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:c6yxknw4FYnshx8OfVe247
TLSH
T19F6523BCBBDEA5D2F50D11734B7163626609B5A5FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 cc7b1bdc2ad018d1b6c2ead9a1be3e8ea553ad42fda4cecea1f810308bbf5f5b
MD5 40fa8908c87a4fd0ce5bc738462386e5
SHA1 ad0c054972f8c0bba7485f1e7a687ce6697390a2
SHA512 542148e4800b1f64f8263a514e190b0094cfa9a9907c471ef0f38ef140f652b4516a3137132932a171d6f8d78fd54e4291f123308dd6105af703e4abc4a76a86
SSDEEP 12288:5++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5+yxknw4FYnshx8OfVe247
TLSH
T10A65237CBBDE95E2F50D11734B7172626609B6A5EA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 a7143eb8bfd225f0ca219176b14771f66db1298402c5953bff7917fa6220930b
MD5 30f69a1a20ca033ea27dbe73002879c0
SHA1 5c4883f7f22056a396f5696b7e66cc9c11a95abf
SHA512 c5fce9e8b6acce78dc4567a7230c3823407df19d2bd17a35a2dca1deb3350a8b9708fc63c3e6d304d5a138e201c6553b75328ea1c806f1089510375ff335ed9f
SSDEEP 12288:PyPz5L85+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:izy5yxknw4FYnshx8OfVe247
TLSH
T18675125B73E530F5D12A4236C9621612F372B872473086AF47A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 77c5cb84d0836b7877d25f7985ef58f1875cadb4576dbed9e280a827182864b7
MD5 8f9a5c06c56192a0a6010c4abe86a707
SHA1 2bb64c4edc032aa550832c53f1f859ab2f9526d2
SHA512 cf96aa2c9218c1c39aaf211da69ea45e2577c967884995055948a0935fdeec6e0fd4a6d8e81577eddbc1ab78b5df0afd49c180d1ee8aec9d824ee0ea23767516
SSDEEP 12288:p6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:p6yxknw4FYnshx8OfVe247
TLSH
T1456523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 d2a3be9a2cb690dc47c0e48f4eca2e3b13114564c78a22f2053978616b12710f
MD5 a442d48d8da2c9cab070b43eefa360b0
SHA1 4c009f8865edc7e4cec49d7d10494049275280cb
SHA512 93951117cdd09bee020926eec86de2a8f86b13308b1ed6ffda95ed7481a4b8e5a196e29939212bb603de6f642c5ad336f78a082e8a8b707a134b8ee54ab0bfcd
SSDEEP 12288:z6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z6yxknw4FYnshx8OfVe247
TLSH
T12B6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 fcddc94b342b77df2da2d7da0b50c3737170f576bc58bff331ef7eb6b410d70c
MD5 a746b7b0bbd19f5da156c06620d40211
SHA1 439dabf9637ae7d81ef82243d86454e4e23d8281
SHA512 d9af7be1fcc77573a1f61b7aab8d272279526ae283ecc241e149960e3dfce9d7a85b10177eea8155b27c36ddd51de3380620b255856d78adca43c0ba315b9459
SSDEEP 12288:wyPz5L85+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Bzy5yxknw4FYnshx8OfVe247
TLSH
T12675125B73E530F5D12A4236C9621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 62f69fda88dbec1a91bf824929f1079acbc6bbcc5ac4f61c33dd9d8ce3271b09
MD5 a51d7dd323c5ec031ba62191fadd268e
SHA1 1c0c8b39a5e1134ec9a9fb61bb4e8219a3de469c
SHA512 96d5cabdd6368e29f7f7b92fbbbc0010bb7729816017a8d74f3a76092e17ba5dc925b4068735a5507b02f56e696f70531c01de26e61b3d6c5632e1806f0d70a5
SSDEEP 24576:iCUfpvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvALyxknw4FYnshx8OfVe247:iCUxPTY+8Wg2lIL8lrIUJLWwjx4x8EVy
TLSH
T1E765AE1DA3DC0896D4BB81358A518A16EB32782E1B32D6CF1160C33D6F67EE55E39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 6499a6e2011ca7a9b254e632b4dadd9a5ab08942db2a006a1a3576bfb2f5752c
MD5 7641ef2bf6e42dcd76c6e3065cbe98c0
SHA1 96a009966b2ba0fc7cb62eb3901447d2ff7ea31d
SHA512 a15df2b47c2633fd8a5d752a4d678532523ba0a2bf44b0b08bc6d5a593e4eb3b81a592cc0877e89c67d6af576418cb8872cd3070691810f0f7a3579bc37e4013
SSDEEP 12288:N+sfK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:LKyxknw4FYnshx8OfVe247
TLSH
T19275F028E29802E4D06E2276CB625641B3237C6597F1D3CB97D0F53E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 38f827e3fc4010f275c531a9091332cf4682bcbd7f549b1075f52031ebd21767
MD5 bc226405a5a277440b9c16114a2b208a
SHA1 9f9f5e763d9132c09e3d31debd4eb533ca3e0783
SHA512 ae0362874b49e361050e6d9fe371f893b903d493d5d9f8a98206298eebda556aab440c68f61ade04dec5aa1d693369a43586f27c80bac02de345e18efa888a1d
SSDEEP 12288:ZP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ZPyxknw4FYnshx8OfVe247
TLSH
T14565237CA7DDA9D2F46D15730676A231221AB1B4DF71C18BDB69B14EE0B0CD0A83E613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 71a598d886fd6bf012ee1e470de62e5ea0feafd4f24ac4f32e68df2669e9404c
MD5 2639c996a7710da88eff64a2fc9d2c2d
SHA1 a5cafc6b3b3a34fe581e95b32561a400a9200b87
SHA512 26e8c441e6b57ebc8f5c2ba7ef4442796819491f87d3971ec8dfa8044f420a3023e095d3a0e404b1ce292452f9b646e902c2adcd58ae6757d062564a47b486f7
SSDEEP 24576:68RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCpyxknw4FYnshx8OfVe247:LRZwQCyiHiQEaaPnMNx4x8EVep
TLSH
T11C85AF1D63DC46A5E0BAD2B8CDA74407E6B27816573193CF0291C27D2F27DE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 7a57caacceeb44ff60b77fc2749cf9f1db6ad3842e5c144724b103401b1d20a9
MD5 590f4250534ae16371a5b030d93a5fe3
SHA1 e1fd65a4395ffc7a61b8ae185b32d96378cc74fc
SHA512 1a16bbed0fb6b1a90b35f11b1f8ef98c2f7a2397d1698f5cab4357bdd0f39101532d77935e7f8cbbc296c8b19a95ca0766461704721c368710fe75f37e7c6d44
SSDEEP 12288:obxA1U7K/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:obxA1UG/yxknw4FYnshx8OfVe247
TLSH
T15365123C66EC24E1F179913A89A18106D332B866573193DF52D4D23E5F32DE49C3AF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 559f6a1da0c7467d8e18996fe31db93f20ab5e50a5daeef451978182dbf74b00
MD5 1197672a0e45dd94d0d2ba7409bc6c27
SHA1 aba5201bf0b2217cb58d80d838f03479644e18be
SHA512 3f2e58d1e77aa3577915f212139ba0fcefd086d95d0e120f38a2ada1695ba22ef2cf7152fb8e1ccf39d8ba98947164dea89c597508d599d1267c404c9c4f4373
SSDEEP 24576:MjsmP0yHaqrVqHra44KDzMsrnoyxknw4FYnshx8OfVe247:MjRP0yHfVqzlAsrnLx4x8EVep
TLSH
T11645AF2DF2B910F9D4AAD136454107B5BB71B42D1F209ACB4170C239AF06EE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 2ff023d99c4ce754dc035c996b3664abda594a065d3877f0e6f4916e9f6a3fb4
MD5 c382a40ef9c2dcec6b0cd4a02ba48f36
SHA1 7204a09dab655d53f13f8bf7aee2413e7dc034e2
SHA512 cf24ba10760f5f7201f1f919e778730b03ce3482db4ff72e72eaad145a67a4e59cfb974f90a78acbe35f49662f52af924afb27772642570cf351a895f8ce20f0
SSDEEP 12288:HB+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:HByxknw4FYnshx8OfVe247
TLSH
T12B6523BCB7DEA5D1E95D15730B7162223205B2A4EB71829BCB6DB10EE1F0CE4903E653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 ffc845986a41d09957e695c79e829c7aed154e41b2bf1c3089b3f4486d4d6cf0
MD5 029cf5be45b009b4c4162799352f2af9
SHA1 bdec4b7381283c1ac9248929e90a418145cd5b57
SHA512 04533550b01a1386d3400cef48744886a6eaa3765465f0894cd02d03240f66ecf06b2e13d39abfd4bca202e1055f96e540c0af3a43afdd611f65693a7b7ff6a7
SSDEEP 12288:YOb6A4LWO+vAYFTD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1CLBUTDyxknw4FYnshx8OfVe247
TLSH
T163850158F7D400F5E86B813DC9729612E272B49D0774E3DF43A88A691F636E18E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 18e7860213575290453f724aa3c8b61101748282c93f2cae99b1a546aef59cf9
MD5 88e4664872ce6556f466e59edc2e5b71
SHA1 4dff50b9b993f013e1a3d9e15b612dc063f04f64
SHA512 47e17399595bcea36dd9c9755f4f38360b37ad2a061dd8c953af4d0f2cb739b3bb0a51ce91d4fe1f2a8851bd744b4574ae50f6992c0004e38fbe18891c17245d
SSDEEP 12288:C70VmwIYNvUyBpW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zgYNHMyxknw4FYnshx8OfVe247
TLSH
T16175F22E62AD1CE5E57B517A8AD38209F2737466172192CF05B0C27E5E23DE8BC3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f1db62a11887241ca2c6dea1ad4c319f20e47f67827f08c6c0f51dbe388dc2cb
MD5 7a4062a3a39ecc51062109b818490869
SHA1 e1833f54bf08c3654d61dc1ccef76eead89a5ebc
SHA512 df20ccde35138e9dda252e11e6a7b678f80fef2715213695516af9bc6d462cd986de9749553e90c1ed287434f485a210cb4e7e382a9267c36943c6061655e0b2
SSDEEP 24576:inXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uK+:inXoJJYH84VVS6AmEcJas+cHBjSSKHPu
TLSH
T11A65BFADA2BC04E8D5BBD17DC5C24506F5B178621331C6CF026182BA7F27AF59E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 61ed99dfd9c0e484b7600fe0c856453d3149adf86505512c1b88625d5309293a
MD5 7f806078b17c6b56bb2c82ae545a556f
SHA1 368a5011bf89ca326c6903398120dc0a0b994470
SHA512 548b72702587e44408e93d992004037503be70fca3b626c78eb16fff7ae9e89bb639729f89c1e2c30ed4304a47e0a9e48621d791f87b8add06f7ed659b1ca1b3
SSDEEP 24576:iv7Xbxd9Tuycf8M/TYlSuxwr2PCuyxknw4FYnshx8OfVe247:iDLL9TuJ0M/TYW2Pkx4x8EVep
TLSH
T1DE858D5EA3EC42D4E07BD6BD85B79146FAB2B855273081CF0291856E1F23BF0593DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 1f9c1e54ed0854b0a0484af14149581ad6a1f8b46e0cf2a4c0fbae12a620cc51
MD5 40e72036a061de5f10661765427e9072
SHA1 6c091f3266af4ee3d5394be7c56648ed4d458f4d
SHA512 441c56953a1223e64cdaad281bef85db79a25d37a11e9d8172d1af06888f051884067a730a01ab28d6bb31e5aacfabcbccddad785e2fccd5f5d9618c9b98960b
SSDEEP 24576:LegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wDyxknw4FYnshx8OfVe247:LngOJOmPOHhGx4x8EVep
TLSH
T10C55CF3EA7BC15D5E03EC17E8A928916F6B1782603355ACF0160827E5F1BEE46E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 26347063fbe996b9bac967fc1b109fc8958ca4e859a43e7875c936143bbf79b7
MD5 24354fb963989538e91a1524f816a9a2
SHA1 b1476999c45e454451289a406d7059a66fe98f1c
SHA512 76ae8ba101a61ec6102bc5633db28b0a746501dd5355944a517e68ffb740445d5addbe7d268de8107fcb5b2a14ca43d43688f73904f27de2549e89186d82c326
SSDEEP 24576:ELJnJiTk3R3waE4JrOhyxknw4FYnshx8OfVe247:ELJnJK8R304lbx4x8EVep
TLSH
T12F85D03CD2A810E8D4B7C2B5825A2756FF31347C2B2169CB59B4D4353F12EE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8f9501d842cd9b1ef00bdc20cff52e878eca77d58e975192c66ca28689fd0743
MD5 aebb205e56f39859a1d90bd81320c4ff
SHA1 441736a0647371d5c1c6d497633f759b5a18cdb6
SHA512 a17ce8f8232824effe5296ce0b920103390cf70e6310b3d732d19feb0b0e38a6322cde77598a6b1b5d999c2be47c3b8d32b5fe9a38af27f573582450ab0b7b83
SSDEEP 24576:hA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6p7yxknw4FYnshx8OfVe247:G9GqCzDScAZmlvTcFg8Ph6Ix4x8EVep
TLSH
T183955D15F7EB5294E8B3CAF1C96294159B327C409B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 49aca467f980bf455a056dca269f662680e028cd149303bb796b7df4a49a0f14
MD5 5b036e5a65850045be94397e3d309d75
SHA1 d8cc403fbdc5b4a9f483cc3ebdcc5c111109944a
SHA512 b3c97bd06f3590583367a7c272557ede2969a47d7ca4abb621de9bae99a2117b20d0580bffc7116f8eabe321f9c5affe6ffe5c7042f543d0a914d670ecf0aa63
SSDEEP 24576:TlYJeXm5jUuEzyxknw4FYnshx8OfVe247:TlYJeXmRUuE2x4x8EVep
TLSH
T10365126C769D70E1E12E507A8AA24615E372F0B1672153EF82E4E17ECEB1CE06D3DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 3f8c8a26ab217ef5899f2e56aade9fa923d5077d753d813bb1ef28031dfe565c
MD5 8f4b178f1b549c1ef33a3c8ab1e73c7b
SHA1 5f7c198568c5d9262a7cb41d4701a65685ac2038
SHA512 06f6f74d89dc63375097f09153594828d6fcc8954cd846aa1141a1e1d816e508475a4292206fe33ba37e64fd07a6b2d06c43648d3959aeff31fab1dc5de7cece
SSDEEP 12288:wTu6kyI+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wKtyIyxknw4FYnshx8OfVe247
TLSH
T15975121873D965D0E97905368A735261AB35BC709F3183DF86E0F23FAE719D0A839B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 bfff53094fbf8a86573cf418a31c672b508de10dba4e1e29eac2f0960d56311d
MD5 3b5d79bd2e807020e286c6e244f14edd
SHA1 6d5dda1d70c564a8688776a6f3c23a32ef3fee29
SHA512 204d8c13f4c42b4e7452219280e7184d6f727e7299958d7f815215cb043d492b146c67b95af60868d8cd3fb5354175a33eeb0b0380ae427db3ea71eceb9f5dd5
SSDEEP 12288:EPD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EDyxknw4FYnshx8OfVe247
TLSH
T1CB65237C67DAB4E1E8191173063262626215B1B4AB7191AFC7F8F03EE5F0CD0A03EA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 78d46d23e3cead837954ba028ebaf395600bea7abf6793e8e9a32a065b0cc4e6
MD5 a4f3970bd553e8c23e8cc1c00a95fa96
SHA1 7ab3540bfc215b1a6c22ef3727cf94922101fdc4
SHA512 f2bce2f0079e6275d65988f9aebe93ff950454cf38779861aa3eba48dba8e7ce633686111e71f0da017188a4e62af82d8fdaf5fd902b73b944f49cc0bc834d62
SSDEEP 24576:jC+TyQIu93VAumZr7jmqyxknw4FYnshx8OfVe247:j/TfIq+YFx4x8EVep
TLSH
T1CD558D2DA7E91DCAE276C675C9A34493E633B472137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 97d14240b6c6044cc99f0f5ce4ae841b89293a35a8f2c6d4c6fade19b2f78ff1
MD5 e1d624a61a82a605eb7d27833e6a670f
SHA1 3b90023f13a7a786eb351c9faa6b296813228cd5
SHA512 b78d39ff07066c3fa28725c06248ac310ed24b1813a3f3354d4b0222e4cca091a26520061383315deb8f26276181c50672344c1ca33c61176c26e64d6841224d
SSDEEP 12288:UcyrWOstaa3kcsn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BLQikZnyxknw4FYnshx8OfVe247
TLSH
T18A75F11EB3AF10E1E0AB813989554212F673B074572263DF42A0C77D5BB78E9BD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1cf327a266e995a53b59c2b09bddcce4b3bfa55ed71dedcdc82e794928f994fc
MD5 6c66caddf3f0719b7841d9e9cd400f84
SHA1 12a7503b89b8615bb20d40d98bce99639bdc69f5
SHA512 190dfb424886ab886b4153b653f59178c94e65d209de9a6b6f05566b8c891832009c97a9d75bf7bf7b6a709e9750294b81d97a830ac586b822fc43f078377457
SSDEEP 49152:ypJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPrx4x8EVep:vpC7b4+80GTkwix8EVy
TLSH
T16CA57C3DE2F810ADD8AA8376C5461665EE71382E3F2055DB01B0C578BF1AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71415c4567d46ea170650fff10b7eeab42be611e790806913e63213492badcb6
MD5 9789c7c089ef4a578012f41718b75ba8
SHA1 f10ca9e0a9c5bd7f9fe2417ed17a9367afe1c19c
SHA512 c63b05975381b6ee9125c1f11a6e57b5e2ba00789722bb744568b67fd3ad17c6c04b41fb834d652b72c909b788aaf84d9823edd6d7d936d674fcf8dbabafb18c
SSDEEP 24576:qSAwJPE1IDAo+4Kt+l44135UQAyxknw4FYnshx8OfVe247:qqPCIo4Kol4/QDx4x8EVep
TLSH
T1BB55B029A7F956F4E17AC7B4D663C611FB727822133163CF8290913E0E169E89E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 1a6b331a9225cca32032d1a6d07f92fc5addbd0a20479c8c4160446c372eada7
MD5 892338fb7d1e0e88c3108196a93eef9b
SHA1 6964e28e8e8bbce895f0060c4fd4ac9b9e6c4b63
SHA512 09100095177c4a15ca4dbb5b727f6ca76a6bb90a811e20fb2beee9582fff2ce771efa4b2b65f4ae06b3afd858db35ea626edf5915cb454f419cb91992999a694
SSDEEP 24576:DyLXPLcl94twyxknw4FYnshx8OfVe247:Dy7Pootzx4x8EVep
TLSH
T13A85E03DE76D04E1E47AC27DC6A38506F67238AD033166CB46A490792F67EF4A93DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 e8342d4fffa82afa81d1c34257be54369f6d250106ea0b6cec18fbe19deac29d
MD5 5975543fb1e81a009e6f719ee31bd363
SHA1 6a77fd2f2e883365a489565743922b8efcee550d
SHA512 6ca5ffb908f01930398e1d545b083bd20677bb95eb7b6e45ce14b3f2042725103936cb826d9b4313103fe286dfd5a76a02d4002bc10a1476c6f57a9672586f8c
SSDEEP 12288:h9lyvj3IkxjbBz3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hWv8qjp3yxknw4FYnshx8OfVe247
TLSH
T1FF75126C67E864D4F47D02319A3282269172BCB6177492EFA6D8E57F8B708D0D43EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-49-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/1100-43-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/1100-154-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1100-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1724-368-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1724-142-0x0000000140000000-0x00000001401CE000-memory.dmp

Download

memory/1724-139-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1724-133-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1856-370-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1856-145-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1868-81-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1868-161-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/2196-99-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/2196-125-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2196-177-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2196-104-0x0000000000710000-0x0000000000776000-memory.dmp

Download

memory/2244-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2244-28-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2600-88-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2600-176-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2600-94-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/2600-96-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2824-166-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2824-418-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/2888-0-0x0000000000400000-0x00000000005E9000-memory.dmp

Download

memory/2888-82-0x0000000000400000-0x00000000005E9000-memory.dmp

Download

memory/2888-375-0x0000000000400000-0x00000000005E9000-memory.dmp

Download

memory/2888-7-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/2888-1-0x0000000002550000-0x00000000025B6000-memory.dmp

Download

memory/2908-12-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2908-106-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3164-417-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3164-162-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4156-78-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4156-86-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4156-72-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4772-225-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

Download

memory/4772-174-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4772-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4772-422-0x000000000BE20000-0x000000000BE28000-memory.dmp

Download

memory/4772-203-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/4772-419-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4772-187-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/4772-168-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/4888-38-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4888-32-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4888-148-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4888-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5004-126-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5004-416-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/5016-108-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5016-15-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5016-23-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5016-24-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/5288-151-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5288-149-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/5472-436-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-446-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-473-0x000001FBF25A0000-0x000001FBF44BA000-memory.dmp

Download

memory/5472-456-0x000001FBF25A0000-0x000001FBF44BA000-memory.dmp

Download

memory/5472-447-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-451-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-453-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-454-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-455-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-452-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-450-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-449-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-448-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-443-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-445-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-424-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-425-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-426-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-428-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-429-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-427-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-431-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-435-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-437-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-438-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-439-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-444-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-434-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-433-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-430-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-432-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-441-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-440-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5472-442-0x000001FBF48E0000-0x000001FBF48F0000-memory.dmp

Download

memory/5580-155-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5580-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5588-129-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/5620-60-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5620-54-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5620-68-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5620-66-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/5620-63-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5680-245-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5680-128-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/5680-117-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5680-123-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6096-127-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/6108-157-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/6108-415-0x0000000140000000-0x00000001401F6000-memory.dmp

Download