Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 22:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe
Resource
win11-20260513-en
windows11-21h2-x64
16 signatures
150 seconds
General
- Target 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe
- Size 1.9MB
- Sample260524-2t99kagy6l
- SHA256 f54fc55e25a0ef99cdb1fa1c6847d5af116c438512e6cd385a852bd22afc48a7
- MD5 bd9850acae53fd940e8ee42273495da9
- SHA1 2f7dcd5b5184b11c81b4aa9b5ad222ae21f4ae2e
- SHA512 42d791c002bf97ecc527c1553b460aa6620e45a9447b87e1be8f32f2237f57e77776cd038f23299204330f6e6adc11a3f2e614bed2f5cde47dc21c5e13ecc82a
- SSDEEP 24576:01CMyBbBC097B/F6A/enKhiQz/JVvs04zJ:01zyBbBtpB/FX/MQVP4z
- TLSH T18195BE54B4A69421C42609309863F2F595A8ECF0AA26FDA366113FDFD5FD2C05D323EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
pid Process 5768 alg.exe 5880 DiagnosticsHub.StandardCollector.Service.exe 884 fxssvc.exe 1352 elevation_service.exe 2344 elevation_service.exe 5236 maintenanceservice.exe 4852 msdtc.exe 576 OSE.EXE 1544 PerceptionSimulationService.exe 2928 perfhost.exe 2952 locator.exe 5244 SensorDataService.exe 3472 snmptrap.exe 2472 spectrum.exe 864 ssh-agent.exe 2920 TieringEngineService.exe 5816 AgentService.exe 4752 vds.exe 6020 vssvc.exe 236 wbengine.exe 1220 WmiApSrv.exe 1412 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\e: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe - Drops file in System32 directory 35 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db spectrum.exe File opened for modification C:\Windows\System32\SensorDataService.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\vds.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\AgentService.exe alg.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\ae474955396076bf.bin alg.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\msiexec.exe alg.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\AppVClient.exe alg.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db spectrum.exe File opened for modification C:\Windows\system32\SgrmBroker.exe alg.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\locator.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\java.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe alg.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164640\javaw.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe alg.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe alg.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE alg.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe alg.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe alg.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe alg.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe alg.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049c75333d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037d25b32d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000115e6532d0ebdc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092766433d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008844d32d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061bc8632d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b703a32d0ebdc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 680 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeAuditPrivilege 884 fxssvc.exe Token: SeRestorePrivilege 2920 TieringEngineService.exe Token: SeManageVolumePrivilege 2920 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 5816 AgentService.exe Token: SeBackupPrivilege 6020 vssvc.exe Token: SeRestorePrivilege 6020 vssvc.exe Token: SeAuditPrivilege 6020 vssvc.exe Token: SeBackupPrivilege 236 wbengine.exe Token: SeRestorePrivilege 236 wbengine.exe Token: SeSecurityPrivilege 236 wbengine.exe Token: 33 1412 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1412 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1412 SearchIndexer.exe Token: SeDebugPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeDebugPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeDebugPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeDebugPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeDebugPrivilege 2372 2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe Token: SeDebugPrivilege 5768 alg.exe Token: SeDebugPrivilege 5768 alg.exe Token: SeDebugPrivilege 5768 alg.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4732 1412 SearchIndexer.exe 106 PID 1412 wrote to memory of 2196 1412 SearchIndexer.exe 107 PID 1412 wrote to memory of 4196 1412 SearchIndexer.exe 108 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_bd9850acae53fd940e8ee42273495da9_elex_redline-stealer_rhadamanthys_stealc_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5768
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
PID:5880
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:788
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:884
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1352
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2344
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5236
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4852
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:576
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1544
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:2952
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5244
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3472
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2472
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:6080
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5816
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4752
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6020
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:236
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:1220
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4732
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2668 2704 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}2⤵
- Modifies data under HKEY_USERS
PID:2196
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 940 2848 2844 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}2⤵
- Modifies data under HKEY_USERS
PID:4196
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 1f5a87b23ad1b69f718945bbb76172b19ea7c6a68397d1e9a8167e28f5c5dee4
- MD5 c2f3eda5a5a1422aa1ebfaeb5440ed34
- SHA1 669744ecc7198f83a641722f8218f9dbfb3ca612
- SHA512 9afe23c4624cebed1805b4557ee9b468ce536a687c7f34d64f1d4ce2ffedc14214d2060cf721b4361ac54c44d99e27e368395865152859540c4326a61f8d43e0
- SSDEEP 49152:Cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5/FX/MQVP4z:k3q6sjBItX/zVA
- TLSH T19ED59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B6562F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.7MB
- SHA256 6b968de71478b9a36661b584e1a7c572b6e74496a2c860184bc8e8a26afbb38d
- MD5 e1c9fdea09ae04983c73c4b681ce0af1
- SHA1 8932f99606cb8ce603ad2b9dd8f9d60c85a95f37
- SHA512 641c45b27a3bddc391fe6078afd038f47cc3560e7e03dbe4254e57f25a6f42017757555596af8bc40ab051e71c679c073822efacc3579cd85163cb8edccd32b2
- SSDEEP 12288:v1XLsswWkxy2lRq2czAs/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:NXYfDtczAs/F6A/enKhiQz/JVvs04zJ
- TLSH T1AF85F12977D508F9ED678238CCA2C112EA33B8944760E7DB03A495661F333D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.0MB
- SHA256 7d25d0e1f2750c97e059d131375f7415757058d5e71915e17ef2b5d07935b536
- MD5 bf9ff4081e2054a5463162da8e0e6eef
- SHA1 b7cd3729590e69708f9b806fa29207783c62ffa1
- SHA512 864ab022de64f28ea55dea0be3aa5a7c2f07f2e9c201fd1cbe1988580391ab750f6fab0adef4156ab331dc655fd7f6513e3fa856f8397ff853cf7a4840f76226
- SSDEEP 24576:u0Le5ji0hmxxrMR/F6A/enKhiQz/JVvs04zJ:uPji0AjG/FX/MQVP4z
- TLSH T1FC95AE26F6748331D073C0B9C5D2A69AE97130865B308ACB4286D77C7F677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b9c8bbd359a4f590b43e081de9aa844a26b9014dd3821d658baa93603df1ef21
- MD5 0386cd15553fc93f665882f9bae67545
- SHA1 49c92e0399eba7ef218484591ff32fc86b2e186b
- SHA512 a1dfbc4a02ccd19d7c66dbb24a54317bffac1732c2a2595fc8767ac29e99a7bcbf42c5184914b7131487e71f48344682030a4002d6069aab188ea6eee731fa6f
- SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWn6q8wyuH/F6A/enKhiQz/JVvs04zJ:2/ezSC6vUzPveHjyK/FX/MQVP4z
- TLSH T121756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 c2d69982d9ac41de40deb051fcb94d73f9167348314be9f115d95ff97cbfc5bc
- MD5 74bd6af7d5935a4212b41377e5387631
- SHA1 0505cc3d70a29733ad0fada9e40129bf126ba8cb
- SHA512 425239db5e4d597cb6233806de7edc5ff3e3e81cb44e366b0a4fa2b0b1cecf291e7afb46692080a73aa358860b25a91e912c52e7a35a49108b379453ea8d1b6f
- SSDEEP 24576:UVbqPb88hv/l+YY/F6A/enKhiQz/JVvs04zJ:UVO88hXl+v/FX/MQVP4z
- TLSH T193559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 27f927d5ed65e397d84dda795c6b5f088ac533932dcb6ab26a67d45b4dff8085
- MD5 743f3abdaa31e0c30561cc63489e84cc
- SHA1 94fff35e47b011ed9992c500e501d565d0c65726
- SHA512 6e93a558f71954d3fe54cfbb44c2a7d5815beeaac19f83526e6b62414088254f76cd2548e4f3b8b092772a4ece4f72cc37aca506c1e5b764ec521ff023cebc9d
- SSDEEP 12288:kLN/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:kLN/F6A/enKhiQz/JVvs04zJ
- TLSH T113652327690908E5F7B10B30EDB5E1F6CB31AEF88861C5AFC52A315B63342C1A9547B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.7MB
- SHA256 6df9e96eacb35537f9a3a57651eb3c2b192814689073eaabbed2dbafa494c7de
- MD5 6c2b9da7bc02c23f0f88694b81f23bf1
- SHA1 5efb03a3438dc9704f32b7592d1a5a34b046d8c8
- SHA512 b084f66e365856429acf0fe5085ed4445e5d79653c358960840d1c78c5a12c0b7602e9fc9ae52ec1d90c3e39e3084a17acb7eff48bd9637d0f1282bcfde7aca4
- SSDEEP 12288:PeBNUbTVO86UQ/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:PJIUQ/F6A/enKhiQz/JVvs04zJ
- TLSH T1F085CF3BEE28ECE2C27A4D789A91C240D77278704F6293CBD175820EDE235E15E79D25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f6551b8b1703d69e07c55a40cd2720944690b27ac5ed8ce94e7d8839c0768e07
- MD5 fc03cf62eb9ad843cc39bb865f83b11e
- SHA1 d7d5c01624b10473d706f4eeb6456cd9e7c591d4
- SHA512 57ed05ee50b94a03bd8ee32fb2e83375a9df4330221f6ded467fa60577f765635573a980a29e2edfc4739efffb78b2431c2107118a118ba13d1901adc743acd2
- SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH9:tQvGAdlCEL8c/DRNw5CXtX/zVA
- TLSH T104266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.8MB
- SHA256 75cbb48c6f7fe3df5be1ce09043336d3f70f380a00aa735b8bfc39ce0bd1331c
- MD5 8c3ef3ab4179c43a8833bba9c514d74e
- SHA1 ccc1687e25b056dae3a71c05dcaba21737d2960c
- SHA512 65f727af11eb4f2e1e1373a5041ad75d9723a17b1c28b9a2c5d2f874f9377822a3482e7ad463513ab5ef3bb18d38497cc70fa97bbbea30d4d2bd80bd96ee784b
- SSDEEP 12288:qAwSfxL/2Dc3RDLLmt0LDQewsAjW/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SQ:/0ewsAjW/F6A/enKhiQz/JVvs04zJ
- TLSH T12485E031FE74D436C3BB0DB25B36D316543CBA604B611AC3E3A8599E5A302D22776E27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 d95a2ed5383f033af879c166fe49294c012ae28a3d951f9c1eee81c3d34627a0
- MD5 ee2bcc8a7194f0f0ec114035dfc9decc
- SHA1 96d4f52c7991c6c495a7d7d816e1a84640000155
- SHA512 b78b3dc7f6a2cc1dfe06f002adf938115339d9545d28a9debc5ec9e9fff7d606ff9f0497ca862d8f42e7dbc5b444c399daf250c897c678601d37f64f2c036fbf
- SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHeZ:1UEtQevvqc2W1cpV2tI32eZ
- TLSH T11F474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 2953986679f8ef45b44028b8d536191c860f5b756e7821e6da2285dc1ecf64f1
- MD5 566ad16fa1f923d25aedb1fbb0fc3020
- SHA1 7791f80f5831865b885ff57690e016004d818585
- SHA512 4bdb7062bd3820922e14ea22e731ed5630a37c0e4998d82b6354844221b22cb95f1f33c951de895bce378bdfcc493833cbf873a343456e18f87ba835875688f0
- SSDEEP 49152:pCbRquA/m2yL5zifFiV+XenmE3/z2/FX/MQVP4z:moqHVjnm7tX/zVA
- TLSH T188D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 238fe93a84c196cca25726f76a1621666ea00eb547d5c2ba30da16a83e76409b
- MD5 52cb7e1ad6a12548545aa8a8c780c282
- SHA1 94af4c6589791c46a31903911cf9cdcb1afab2fd
- SHA512 748b59ac6e5a81da9a8b84ee91d1a410013f93e52b4c0b6310f6c147b8a65b3d4d85c21176b6ef63e077c7557ef2eb901e32dd59200023c26b7ba2921d97df95
- SSDEEP 24576:SAhGL3IFoiwtA5l7S53b/F6A/enKhiQz/JVvs04zJ:SAMUFoiq5L/FX/MQVP4z
- TLSH T1F7359D81E7F945D4F5F3AA7899B69171EA76BCA95E31C20F2160D11F0E33A809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 e4e9ef1e7ca815974ede8a3b811c6d08f4d269307139838d85b871b10a8e7721
- MD5 147f79044702f3c04e5fec868a4fcdb6
- SHA1 9d8c2bc0ef9a6dec9a7d412fd8811291ca2f1720
- SHA512 ffc197e94c846ad6fd74467619961c6d0ea4fceb97a2a9c06f2511c5da840eeddc5203ba597d7869cffb329e19c4967c1eb74c54364bc34ecc0d214634598f93
- SSDEEP 12288:9mw5HEjsChNVBFgl0WDm+Cn/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:4wu4OWq/F6A/enKhiQz/JVvs04zJ
- TLSH T1A885F14A36A50CF9E9B34638C997C136E7B2BC512921C71F4760C25B6F373A1AD2DB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 4264a0d0f4bc3225d4b0b22989bc24fad145040d66be99a0d47215a83af55d34
- MD5 f4d194e007a02dc4ab5904eb54871d74
- SHA1 570c0f9ee25eab9393a45f0878d031c9f3bb06dc
- SHA512 c46affbcbc40cb3e5f7b286252d66c447aa75ee0df4bf63a6611c144eabaaeb976744dba13267651ee330b53d0e908afcf10b0366b1ce2169c60fb2e120d9cc1
- SSDEEP 12288:heZ1Iym/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:0ZuJ/F6A/enKhiQz/JVvs04zJ
- TLSH T15475125A329410F9E2B30638DDF19256D772B8F5673283CF4629126B2F32AC11E39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 65dcc24611010a6e7fa5cc6551832477d8438b1bdb786b23b533819f3909b86c
- MD5 1d64871355c975c14b276095eed9332e
- SHA1 9e44639d51fff9536f9347188f5ae97dac288579
- SHA512 f3d7c24be44c5ac8e7fc197a659f488fe71adddd5c14da3f0d399350f6a07278e9154018033738cab0ef84958c4765b41e194a4442a53405cb448b3e4c94d711
- SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ux:oQRQyi36YOcPbLvw2gAf+PN3EtX/zVA
- TLSH T1B6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5cdce145124981c524d2528bea247d63d352c5a683cee2dcb380410548fa9380
- MD5 28e60da8e9e34f221c9ffff4a9012081
- SHA1 c31c8e7fe9bc04ff11fe720010981597ff5ba511
- SHA512 1fab9d2839337f52729aa412f000cd8bab630c52de1fafe1f87a9cda98dc8a483db10e9ff43666a16cd74d3f694ee0e615130127673411b1fae7da9cd83a0b98
- SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ux:aQRQyi36YOcPbLvw2gAf+PN3EtX/zVA
- TLSH T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 f5faa7b1a027c00412b9e962d26bde808bd97205629810886cfbe740373f98f1
- MD5 58cf5b89cde02ea7d355c772e2660504
- SHA1 8576eb32d98a60aa99771a29f9c1449ba61016d9
- SHA512 dd451f546e0b791aa4919903c7263b938e4dbfb32ac27cc1bd6d3ed2c94a7fcd77cb7d9dc7db2c6de2702d8d300aa332f18b1aaa9f4278f01ed6f5a6b9001043
- SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05/F6A/enKhiQz/e:G68Qg55nhceWu7PNU3/G/FX/MQVP4z
- TLSH T1B7B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 5000d6fd6cc0dd1ffe99f1f4def03319bba33fb2812ad37d02580240e8d3c033
- MD5 7d5819a933cc850955fc28e0c7cafda8
- SHA1 7c3943532912b283b69a8cc1c49f08b4d76f618d
- SHA512 9b032c612bdb28a2a4798059207f609fcb2417b96b83e568264ef45eea6e972105eb80c3bb8d4d5d9ab79806ea8344a5ae72f5ab76a975f4984708fb14a025de
- SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99z:Jy5112gYy5azzVvt69nLKnhZNtX/zVA
- TLSH T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 24f159132747ac0179990796a6c417863f7ab0757bc1edd3e9f6de38a5a2ae1d
- MD5 e737af2a83ee58eb22c4a2ad217db5e3
- SHA1 cc8d0848b9a5a04a6ffe5590737badb264ecf061
- SHA512 8267419cbc23b2a9df6f69dec3e11244fe30342e0f678d37dfcf9b26bba255fa42147ea3be96dd2c9097fafd6b0a49cfd726368ed52d3d6312dcd46efb491020
- SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glc/FX/MQVP4z:gu6Jmdxd2dctX/zVA
- TLSH T1FBD59D13F1DA01E8D06AD578974A9233EA62BC490B34B6DF0A9073562F77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 8788c1064c5e14e503657e4e2d470a0ed6f38a79d3f3419773861ed5ac8f8f67
- MD5 1276347063500be7ec4d951d07c1a1b9
- SHA1 2d97542c9b44301df001714d9a209572f6ed5121
- SHA512 22078cb13a6b4c515b6dcaf8fd9fcf2f445c9e752ec3e1fca5088dca8fb1d7d2c1475d9975fca7af5b5573512781a2d595d694fbfc50193766bf3455dc5fd225
- SSDEEP 49152:z1hpsNoJpF1A63U44CwH7R4xw/FX/MQVP4z:zmifPWR7tX/zVA
- TLSH T136B5BE13F2D900E8D06DD17887569232EA62BC450B35B6DF0A90B7961F7BBE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 2b1fe8feea95a224757215db9047ca66b7b9899cdd2969724ee84016c3b85801
- MD5 b1b1d5ec042e6db6cb63b39361087237
- SHA1 8c04667b815740a3951f512ddc0742b450cb5308
- SHA512 ec5039d1d1511ed240b0db241ccdb091709e9cff696f83a21f7bad687aacc5015733dbad6d08a6ca8872f2c155852dfb0f8d6194446b3b6ddccfff161e99523b
- SSDEEP 49152:RSuZQIY0Be2KcRVtOnks6NMHqJ/FX/MQVP4z:/5dKii61JtX/zVA
- TLSH T134C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 18d30cd747437f69898dd0d82dcc87683193e35afc03b41c87d302e9c09b70e4
- MD5 fdbe97280f5faea6425bcfd57785cb6d
- SHA1 b384cd5e2d3367f9ec4d690a47bcc235d973385a
- SHA512 6c341fef4bc37967889e935eea07677a58c48c817dd0edc48efa4bff863e98f84052cfa13501636b4b9fe35b3b429fb7f4b4b74638b30801089e1ad1cb3237db
- SSDEEP 49152:thtSn8EApI0fig3giDn0AP5ws/FX/MQVP4z:8X2imph/tX/zVA
- TLSH T1C095BE13F2D900E8D06ED178C7568632EA62BC150B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 defeea0124786be1ae3838a96a44a92507d6120b25d553b6012e156a0063cfd4
- MD5 c7e845b83565bb4478403a87b36ea3af
- SHA1 9a76063c0c3cdc072ab41a6a3d1617eadf72cb3b
- SHA512 5eb601fda2b20aec40111f392d3608940c3b6938828ebdb9376a37813c1d29fa964f761f84d4ab9ebf024288503bd6224bda6ed7ea80a7c227506524569b7e78
- SSDEEP 12288:qF/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:qF/F6A/enKhiQz/JVvs04zJ
- TLSH T13F652327784A48E9F6B00B30ED65E2F6C634BEFC946181AFD52E301B67746C12914BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 de9c42dd16296c5899135b86cf0a4aae1d59f4d4a9e6a145b7de044e90a93314
- MD5 9a10e62785b06de86bc4762f44be13f5
- SHA1 ebb435f69bb7f2a9629aab47893f570bc622f880
- SHA512 20ebb1b63b2b1523d7321b17adce19ba32cf3ba6caa96f530c2dc4de71a0f1409789fd63346c9446b387f013fc50d38ab886142f34c873fd2ed7508e46e6a3be
- SSDEEP 12288:rS/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:rS/F6A/enKhiQz/JVvs04zJ
- TLSH T106652327784A08E9F6700B30ED65E2F6CA34BEFC946181AFD52E301767746C12954BF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 d29e43a5db6d978db178417839a782a3080652da3a029fcde4e4193bb51b73e2
- MD5 b147cb1598f8c87d5549170a63d0e46b
- SHA1 b89da18f98b77c51376d9c53294f04a6ceda44da
- SHA512 6b9193763686b1779d8a5abf1dc6e650c8b3257eb009e5081afabb61c507408d68653bf7c0a3e1bfeb22b08c4d2c01722ef7ba109de74d4bc786473ceefef920
- SSDEEP 12288:SI/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:SI/F6A/enKhiQz/JVvs04zJ
- TLSH T1B8652327784A08D9F6B00F30ED65E2F6CA34BEFC945181AFD92E301B67746C12914AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.5MB
- SHA256 1b50f6460a5e6f3ee134f60ce68e9aa4e048582d54aedf2d4065e90dd435d801
- MD5 edf7f90b2809599a1f418b16c08bc770
- SHA1 dbfbda34540dfe7b6b1262847ac98db77c0162dd
- SHA512 84daccd5ae9b13e678d98a1ab635ba1adf564c89a14ddc872422814a5998e89f270cf3fd02e585f259fe6779d5c841e6bf308aa6a8c9946a20a2fd5390b0b393
- SSDEEP 12288:WV7/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:e/F6A/enKhiQz/JVvs04zJ
- TLSH T1B56523273A5A04D5E5B19B30DD72E2A6D775BDF89432C2EF9A19205B1B703C02D34BB4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 57ffe6ffa632c851922a0c0dff287faf190c0cfc4343f4a7a9115a38b19ea010
- MD5 0665b2bd07e2a79e5dce3bc85f884ac5
- SHA1 ae80d69a609fbabc12e9e0fd0475487852c6b697
- SHA512 2c3faa5135a006375c62439bf03f2ac1604ced0e9fca45b622c82cef3c4849c7ca013b292b72de87db6b4e53eaa0acd3d173d5d3c1f15fc91eb83b3a27aac8d4
- SSDEEP 12288:5j/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:5j/F6A/enKhiQz/JVvs04zJ
- TLSH T1C1652327784A08D9F6B00F30ED65E2F6CA35BEFC946181AFD52E301767746C12954AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 d75b862d9062e14067edabab78a2fec8f4b1385a153170783223a6a84d331bd5
- MD5 dd51de81a3dd3c4241be341e1e8484e7
- SHA1 966130d9fc64a65b1bb2e3b87487038e08ae75be
- SHA512 d733f59c407b16fea38e48105b8614066912b7cb9642c210f8d2c289de2aba26426a82504ea9d828f3b86cfc759bef0e9bb7045581bb90992a67f50a79ec8f42
- SSDEEP 12288:zu/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:zu/F6A/enKhiQz/JVvs04zJ
- TLSH T1EE652327784A08E9F6B00B30ED65E2F6CA34BEFC946181AFD52E301763746D12954AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 70310c2a8ea0b355d00d083dd0d3386fc71868bfb92c0180ed97877a1906fc29
- MD5 7287e7ef30ba4f563b8acbcfc1a253dc
- SHA1 7a2745f165453e06f1ed73d574218a5ec7ca343e
- SHA512 7968feeef20873b8bc1aaa734bae6c811c605e3c64662fdaf25aff234d082885a444a5e96912e210643aab87e5a190e39742d61a6d0da2836d92bf322c4d514d
- SSDEEP 12288:ha/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:ha/F6A/enKhiQz/JVvs04zJ
- TLSH T169652327784608E9F6B00B30ED65E2F6C675BEFC9861C1AFD92E301763742D12914AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.7MB
- SHA256 5aa668d220c458c7e00175d1025c9a6c7ad151ae12e0f04a2290abd3bb4fc595
- MD5 4953c9c8d4f1154ead4220b543012dce
- SHA1 8efb2680c0326bc1d33be0d7b888359d61a92203
- SHA512 dc545ad1ac26a54c51d219dd16847d1ce94d1bda8c27a5bff11aab5cd822ddf4d99daee288be6f049d8e4a566f3b4882ebdb70efb79acf41b88657d12eb9d4b3
- SSDEEP 12288:KiZwbVzzFEoS2cPvyy/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:tZMRzFVSOy/F6A/enKhiQz/JVvs04zJ
- TLSH T10C85F1A5B35008F8EC73423ACD659956D6B27CA90A70C65F03A8326B5F333D11D3DBA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 f9e9b8b04c147fd47c307c6d537d463db84925f9f02c2551bc87ce97bb117bc0
- MD5 69005ce84574589cbd0a5314c34f9f03
- SHA1 4e63e246c62388a2510577c7d470974d16f540b1
- SHA512 def769b2b13824481075ab7125712f34e258556cf36b27bed14a2544d37b6590a520262e23fc9e5a7516d30c7d2c500b23e9b734b55d0f48c0c5514ebf8eeafd
- SSDEEP 12288:eZ/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:eZ/F6A/enKhiQz/JVvs04zJ
- TLSH T1D9652327784608E9F6B00B30ED65E2F6CA74BEFCA451C1AFD52E301B67746C12914AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 8dcae22c93f1844e20cdf7fe14b9cade466f1220406e7117250fd325281545ef
- MD5 6c89adf17759632d034a38fe96aa5f4b
- SHA1 8431e5602b0d1ca782c3f0792bacb7ba4ebf50e3
- SHA512 92dc716ae69f9134b025ba2a47b232047815a8363dfcd8bcd3d25f94b571a64c3888ec01c6f7460adfdf798d3520d6af8a906174bdc405b3d0967970069e6f63
- SSDEEP 12288:3d/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:3d/F6A/enKhiQz/JVvs04zJ
- TLSH T1C9652327794608E9F6700B30ED65E2F6CA34BEFCA451C1AFD92E301B63746C12954AF9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.6MB
- SHA256 5696521c52d012dc9bc31f4a0597c02bdd23e9685da87285c499169210a73649
- MD5 f0447309f3a77cec52a6e108423c2d32
- SHA1 30e410fa78e8fa45286a83e75894f5bbc548bd2f
- SHA512 a7cb11a70caa7a8424f7cc437d5f8b4618f168f8b45f248b7cb238cdd31fb1c008cc867353a53f1c7979b6dd9e284ca27394bc8d2128ad963c9537333b856f90
- SSDEEP 12288:qyPz5L8m/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:3zym/F6A/enKhiQz/JVvs04zJ
- TLSH T1A575021776A520F9E1728234CCA25652F772BCB547208AAF5764127B2F372D06E3EB70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 8aa44edda62f5f141318397ffd8ae30fba558cf3bb171c2e10f5800f8dbbc5a4
- MD5 c4f9f26782934eead55523a106ede059
- SHA1 ab84baf8048c833fb7c00d2fe2ea8c5642ada5bf
- SHA512 207cd0b361cec561b2d0208c84312187cb9e5dc87c1e9aaf28e65920d0eaac43686b2dbeeeb2bfa4c7279b15e351ad4602523c2a9a72d2c996fac41f4ddf736b
- SSDEEP 12288:oZ/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:oZ/F6A/enKhiQz/JVvs04zJ
- TLSH T17D652327784648E9F6B00B30ED65E2F6CA74BEFC945181AFD92E301B67746C12914AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 abce11ad2a7e3b8184dac0bf927846358bcd39d96be3067d07fbb096fe38e442
- MD5 7b19cba93d77670703e5c8e84d216c1e
- SHA1 064fd3d0383cac770a7fe6fd1ebfadba822907b2
- SHA512 e1eee4da3e0ac4b5a0fb47a5f49bd4dc51bfeda56bdf1bdae22cf575feb3ee60231f5f428d34876405e9947a4a422b04f8bc68635c3cb7f52fbf5d200851a275
- SSDEEP 12288:1Z/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:1Z/F6A/enKhiQz/JVvs04zJ
- TLSH T141652327784608E9F6B00B30ED65E2F6CA74BEFC946181AFD52E301B67746C12954AF8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 aaee43aa490238be6242168ed38afeb86fa8737ccea26b5a609a485748d10d0d
- MD5 5bc3853bff92d8c926a62a9f0ee6ebad
- SHA1 f945953af35636326198230043c2cec7a00fa8ab
- SHA512 24539d03c62e7d0fefb582a15c4568dcd522ec91d6cdb3981282545750dd2513b37093cf17cb310f4def996a44ad7b460ece29ede4351d333794d943da88c2d8
- SSDEEP 24576:4CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvA0/F6A/enKhiQz/JVvs04zJ:4CUZPTY+8Wg2lIL8lrIUJLWwj/FX/MQ2
- TLSH T11465AE1EA3DC0896D4BB81358A518A16EB72782E1B32D6CF2160C33D6F27ED55E35F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.6MB
- SHA256 5108a79fe345b6943864ad2dd6b2d3441881621262f3f0e150fc842465848ab2
- MD5 52cdd6380c788a048cfc89c4c0f94a4f
- SHA1 d90df4c3022091ea11ec60d0099db7a806314375
- SHA512 4e3e15556dfcd5965367d2660940de736cc35dd7179e740239ba78b5366863f4e7eccdcfb3f3c6d90b1e412afabdfb3f083aba9a0c245955e4dd92527b9bdff1
- SSDEEP 12288:AbsfJ/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:nJ/F6A/enKhiQz/JVvs04zJ
- TLSH T1B275F01AE29801E8D0AE6235CB569691F3337CA486E1C3CB96D0F13E1F356D06DE9B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 184b49d80bc419852ca910423e1108926d96f44c3fe6c0afeb1568903b145fff
- MD5 6f477cee38b2b3057d48313d34a9bdc2
- SHA1 d5d4be5d4615449aa17a527dd04d4a99e26d4831
- SHA512 6ca73b29d8b668f5141e8c97cebfbac982e3944e9a9bae6dab5693ab207c18b4141bd38bbcdc6b9bbafc500a04abe64e14c57a2be0a91c32f0d59bfe626dad83
- SSDEEP 12288:5o/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:5o/F6A/enKhiQz/JVvs04zJ
- TLSH T121652323664948D5F5B11B30DC76E276D729BEF88A21C0DFE41A315B63306C16D34BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 7566fa05f00a33d7e5fa165d9b6556405c0eb5aa914d60a480bc83dae088ee32
- MD5 0022142597dc3e78aef1d5d5634ed7da
- SHA1 938f416c98dd464f0c58ad8e063244084962845c
- SHA512 14df8940d2e354662817b42863420752fe8eb9315dae72d7c156a3d0fb5ab6ecc1a2d7949da60742c4242dc6265e747f41e70f10b16076248d2e82528742d547
- SSDEEP 24576:i8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTC2/F6A/enKhiQz/JVvs04zJ:DRZwQCyiHiQEaiPnMx/FX/MQVP4z
- TLSH T1F685B01E62DC46A5E0BAD278CDA74407E6B27816473197CF0191C27E1F27EF49E3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 e78773fb4e75ffe8e272d6b305ee86ffb3af8babb5bcaca6f54377a26953e22e
- MD5 b03881304bb232cccb4d5c46fd9c0931
- SHA1 bd40fa0f6b2a88e041cb6cd08fa7ba9c42b40ff4
- SHA512 6112fa29ed05b8e4a63ad44e7cd770226fb19ce6815b535708ec9191642d401eade5cfd3c82e32ec3f077dbf3a1a615907968f7d6a7671bb0b104f3d629500e6
- SSDEEP 12288:KbxA1U7K4/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:KbxA1UG4/F6A/enKhiQz/JVvs04zJ
- TLSH T15275122E269C08E4F1B19639DDA2C106D331BCB9572183EF6095927F1F36AE46C35FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 b98d38d2c79c6edbdfdceee63f2e7cb1d74334e3553c8c0c010d48e8281b9ae2
- MD5 92e79180b711876000b0e15d677beb17
- SHA1 228893227188ee73f284703d00cf2cb97ae6b818
- SHA512 787aa76572e35ae8e936c6091d68331e52a31d7754a07c55f85c2cbb860de2e53a2b66298db0f561fd6c963085d68e0944474f29b71e865150fffba87eb9a153
- SSDEEP 24576:CjsmP0yHaqrVqHra44KDzMsrnL/F6A/enKhiQz/JVvs04zJ:CjRP0yHfVqzlAsrnL/FX/MQVP4z
- TLSH T17A45AF2EF2B910F9D4AAD136454107B5EB71B82D1F219ACB0170C235AF0AEE89F35F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.5MB
- SHA256 d2507dfd84fda8a5eb763a2a66540fa306e77d017408ce1d0e9522c3f4099501
- MD5 60c5c31b3e32aee01578113e46850619
- SHA1 f0c8cb55981cc995493b6014f79fbd4d141720c1
- SHA512 c560b4c00748a854776cdeaf668069f3d1d90c901b34f510127670d3607f3416f95538b7ce0502fcf508f3ab03af72adf06f48f4443e44b3e5a9f465f76fece9
- SSDEEP 12288:UO/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:UO/F6A/enKhiQz/JVvs04zJ
- TLSH T181652326754A48D9F6B00F30ED65E2B6D724BEF8582182EF942E315B63746C22934BF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 fe335206af0c137d70387b14330f73c7e50c01e5ef8c4a0d16ab037dbde97fc8
- MD5 e5f772235a1dbf9e0ee85e40a2169618
- SHA1 7d3c030ceb1bc3c7bcd67b858a49bebccf6d310c
- SHA512 ea9514325eaed35a3267314dacddcf7461fff968be43d1f98dde644e78f919b8a421b275da134dce4343bd1b3c62f69e161bf8d76375caf5b20318ca4222d2ef
- SSDEEP 12288:LObfA4LWO+vAYFTs/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:UbLBUTs/F6A/enKhiQz/JVvs04zJ
- TLSH T1C295F115F79500F9E977823CC9629627D672B8AC0760E7DF03684A661F237E14E3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 951e6f55a0257f58da12c3e5f82ce17a89e75a7e31a609def851a57bc45b5332
- MD5 36d596b2a556b99fffeaefa1267a24b1
- SHA1 e8a006a2bdf83d64a9e889b911c61d6a4e4539cb
- SHA512 c659b9c70d223d0642c82eb6944d7e11291005744a067af7435d14526a17987daf06174e7cceb2471dfe6a6b82b620aea8300569c38269c7dc2143f40a81f9c5
- SSDEEP 12288:/70Vm9IYNvUyBp1/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:opYNHP/F6A/enKhiQz/JVvs04zJ
- TLSH T12185F12F62AD0CE4E5779139CAC28219F272B8A6171192DF05B0827F1F27EE87D39751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f73c3c559c771d3bd4d435c2c6bc53ea0181ff3090a4a6d180a3db00985c7c8f
- MD5 837214102fd402b6f11a5c9e8c471077
- SHA1 8ec273f34bc8563152b16586807bc77933478825
- SHA512 79b7479e7126b1fd3402801f73a33b70ab4908bf29757625021082c6afb43b356bdfbf3e400c2439e178cf71ce4dbbff41cff51478674d9e28d284862699d961
- SSDEEP 24576:PnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKB:PnXoJJYH84VVS6AmEOJas+cHBjSSKHP/
- TLSH T1F665BF6EA2BC04E8D5BBD17DC5C28506F5B178651331C6CF022182BA7F27AF56E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 05bc6417833104aad3d3e09e9f99c73504dbd8ad6e7f5cd89af51c328e7256e4
- MD5 cf99b846d5c216c7f9f16aec538e9872
- SHA1 1245cb0d9c03c7be3b0d962c28f4f81dc3590121
- SHA512 c8d78d072ac8c53c59117fc2342fe3e8a8a0f8d6cd7401dc39f46843691a4b84a8676157811b65eae9c1418e0f1686856a72324d1e8e87b10814df50b33b9d22
- SSDEEP 24576:Pv7Xbxd9Tuycf8M/TYlSuxrr2PCt/F6A/enKhiQz/JVvs04zJ:PDLL9TuJ0M/TYj2Pu/FX/MQVP4z
- TLSH T11E858D5EA2EC42D4E07BDABD85B79146FAB2B895173081CF0251856E1F23BF05D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.3MB
- SHA256 2b908615d0a55ee77e0e2949765fd061eb4434c8a745bc47147de58318700c98
- MD5 c714f6f81e7dc869aba38cc49beb4371
- SHA1 fd369ef733979e74ec6c753b15e738257d6d216f
- SHA512 1456f42dad568e2b8b376e0b55bb5436f9579a7b532acea38d9badcfab5b4890fbdc93595607b5b4da602eff9b1d80d7b7a7e68c87c1a0385b721a672acc52dc
- SSDEEP 24576:7egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10ws/F6A/enKhiQz/JVvs04zJ:7ngOJOmPOHzs/FX/MQVP4z
- TLSH T1D355BF3FA7BC05D5E07EC17DCA928916F6B1786603255ACF0560827E5F2BEE42E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.8MB
- SHA256 98469669057d01d2860e4cc0b1908af2a79e649f891def573df319489026a060
- MD5 8a4a19506d384a52a8716f5a7d2b1b5a
- SHA1 5428ac793692fe81bde9cd338690fbd18f21bd60
- SHA512 2cb633f7960ee50846428a80618242f6095cc7e26e73526960cc0a3dfbc9d88ce3dbfb7122de457a0a780972db0289ddf865fa54f9c956be945d9128d04f26e3
- SSDEEP 24576:aLJnJiTk3R3waE4JrOu/F6A/enKhiQz/JVvs04zJ:aLJnJK8R304l7/FX/MQVP4z
- TLSH T17E85D03DD2A810E8E4B3C2B4815A5696FF31387C2B2169CB59B4D4353F12FD0AA79F58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 34a2ba7920ef5c9eb9f50b7e0243396f59317d583b1d64580a807f78cbbeca87
- MD5 bfc8068ee6ee2f694a9d9ab10040c4bb
- SHA1 295419f06f063a6a59b78d93b7162b077e25e15e
- SHA512 be56fee2d55643c0c41b72940510a86385551a5b7106b1d9f126c5f157b7eca4ea98047395dc11f233c37d17c0c9e1bdc0c6fabf49bedeca1ff89919088faaa3
- SSDEEP 49152:E9mqCzDScAZmlvTcFg8Ph6a/FX/MQVP4z:WvtX/zVA
- TLSH T171955D05F7EB5298E8B3CAF1C96294159B327C509B34F7EF4A80CA6A1E32BD1D534B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 c1cd9a6cdb32f76c679951c391a2546f416c62eea9f0c6b2537d9eb21807e452
- MD5 ecae072f8fc8ad6ed9c7c517d336f964
- SHA1 828d44fe859d6940de9260d10eac45c1e73b818f
- SHA512 4cf5dc14bcd4d090e590dd4e4bd0bf38335fe86155e458f3509a9e63beeaf774bafc05901e72070f45a698cc5e07deecc4f6d784711648ae304e0e198bcbcfc9
- SSDEEP 24576:klYJeXm5jUuE8/F6A/enKhiQz/JVvs04zJ:klYJeXmRUuE8/FX/MQVP4z
- TLSH T19275122E369D20E4E2764638D9A28265D371F4F4531283FF91A4D17B8F76AD12E38F90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.6MB
- SHA256 1ec05bdbc0b8141f968c8b05bdf5df1953797aafeb9d92b992eee29a6dda0471
- MD5 5c6d3f7bf0a92294dccfa90cd05fd651
- SHA1 4a57c82b1b890a5c548eb527bfdfc2e4db05f60b
- SHA512 b021a801f0cae1a965de7ad81f2efd683ac421ae85a4798504c36b1993281eede8cb5b4e517bc4def07306116169578e58889291abc4a03e7418795ec1281539
- SSDEEP 12288:gmu6kyr/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:g7tyr/F6A/enKhiQz/JVvs04zJ
- TLSH T199751216329444E8E6B10A34DE7382A5DB35BCB49B2183EF94A1B23F6F357D06D30B65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.5MB
- SHA256 5a379d342bf19f039fd5f2cab6bbe74f823d4c04cbdc8ee8b0e2384504994318
- MD5 8d866cfc5623cf7debe9728959391514
- SHA1 72122bd4b12aedb727324c7354542a7fdcd86e74
- SHA512 b12ee4e0c667fd66667011ff30a7ded678c1e9fb76f691db38804b4d197f6bb40170dc08b381da080ede9057aed7c6b23c2d078906991d031723013bbf9ef950
- SSDEEP 12288:oPs/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:4s/F6A/enKhiQz/JVvs04zJ
- TLSH T1ED65232A254A04E9E9710B30DD36E2B6D735BEF8982181FF9469B03B97742C12934FE4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 fc1442e08853bab8058252e0ce2264517002ecc870dadc2db2a37d22bd10138e
- MD5 f8662a573427da22bbef492987a83eb0
- SHA1 1f35fd31b80887ef3ed42ae8c33a098ce1d40535
- SHA512 f2401e4384715aef5d2efcfa87f3d84f8b9e60259a99f90c0b8394aac3bd82c119132ad5470229322a9188b6dcc3b17e327d05fb4c25339cdb58cedc725d201c
- SSDEEP 24576:7C+TyQIu93VAumZr7jmp/F6A/enKhiQz/JVvs04zJ:7/TfIq+Yp/FX/MQVP4z
- TLSH T119558D1DA7E91DCAE276C675C8A34493E633B871137186CF2044C07D4A9EEE9AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 d982e576fba0dae9621cea3aa8bc850e9c3539ab13241be7eeb33b0081ec626f
- MD5 b52023943d7515129da28612ac82da78
- SHA1 be415a4114847f1679af2df3012e16d44cfab052
- SHA512 d4f3913d767dfea368fe591c740613317da3d6cb74f652018dc6b143021af7e40f4415053e1b8d25d7ea14ea9cf0c26903bae245a989bd50a8d64e17ec3a7bb5
- SSDEEP 12288:kcyrWOstaa3kcsA/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:xLQikZA/F6A/enKhiQz/JVvs04zJ
- TLSH T14875F10FB3AA00E5E1B78238C8958152F773B4B4571293DF42A0C37A5B676E97D38B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 6f16d048a41897fcff5b4466a0f9e821a4ddc6852613d488db2eb07082bf477f
- MD5 415ba04094fc53ebed6f46bdbd8fc13a
- SHA1 a4bcd492966be92cd5e2fe43c6ee753e8dd88bd9
- SHA512 8114543fcd838f4c8f3ad9639ba0ee384c59e3013461b22127a0cd0545fa7f267fea0220a52f14d6d1c96a31b5e27e01b4654ce8ce852a3b8591968b61d41641
- SSDEEP 49152:tpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPr/FX/MQVPY:upC7b4+80GTkitX/zVA
- TLSH T1A0A57C3DE2B800ADD8AAC775C5461665EE71382E3F2055DB00B0C578BF1AEF19A38F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 231a8b72f684aa2dd868ef1d7177d64a90b2a96608f200f033c76c82531ac352
- MD5 9df8596387947e96c1fae8bf27aa9051
- SHA1 1a66136c510e769b232a6d49aa15dbd745de88c4
- SHA512 544a513bd850e43f1215ba86877f30b8235f4c22c07461f326b8b04922f57f79b4bca6227cdb5034798c4a08eaeb9767c18f3fb06d89a0e03f7d40a92dc775b2
- SSDEEP 24576:XSAwJPE1IDAo+4Kt+l4413JUQD/F6A/enKhiQz/JVvs04zJ:XqPCIo4Kol4vQD/FX/MQVP4z
- TLSH T13755B02AA7F946E4E17ACB74D663C611FB727822133163CF9290813E0F169E85E79F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.8MB
- SHA256 1955c179dc7f2d0015174fabaee8ef5b2b72c7f163cdd15d021f49c1bfac3927
- MD5 c94f02bf681e0e89a838c0b9eb608c3b
- SHA1 359958d7732e43ac71b68510e6ee1a837e677e85
- SHA512 ef460501f75a6d78a602f50a6c6938e6d0e619c9a2305e6fb1b007e473eb89456737a79b847c7aafa9a2ec0314443fdfb2529437a3391832766b339d00962b3e
- SSDEEP 24576:YyLXPLcw94tT/F6A/enKhiQz/JVvs04zJ:Yy7PoXtT/FX/MQVP4z
- TLSH T19C95E13EE66D08E4E476C23CD6A38506F6723CAD033166CB15A4907A1F6BFE46939F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
- Size 414KB
- SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
- MD5 16b9618962f5623ca791a1366eee5708
- SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
- SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
- SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
- TLSH T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.6MB
- SHA256 1a9263bd4c1c0507b7af48798accd1f2e91fb2d645daa8649f902f43844991f8
- MD5 814eb2729edfb1e0bdf8d91f5acc4983
- SHA1 3d1ccf29bca9f8dc0ec37652efe7ba4150dc228c
- SHA512 4423bb61e5d539b91b54ab1d06903c099ec32d5a77a271d8b890b9bb8bd3be0a4f70ac2e8c50c349c05af8e3410de41871f9ce74593e4357c795fca29ddf52b0
- SSDEEP 12288:B9lyvj3IkxjbBzw/F6xS/iuORjD7ZTMhMZQz/VqoVvsRBwDU3SszVD1:BWv8qjpw/F6A/enKhiQz/JVvs04zJ
- TLSH T10175122E269418E8F1754730E932C266C271BDF5176186FFB4D8A17B4B34AC0A93EF61
- MD5 SHA1 SHA512 SSDEEP TLSH