071f0675155000069a3a4b573a6fe4c3dcd68139b665f86154db39f08cb18deb

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
Size 1.5MB
Sample260604-tmpehsaw8y
SHA256 071f0675155000069a3a4b573a6fe4c3dcd68139b665f86154db39f08cb18deb
MD5 ab9f97ff5b31fde05fb9add4757600a0
SHA1 2570c49e53438575b6e7aec5a62fdc926661737b
SHA512 6bbde09a973484876d849f556012d36f33a82d0d2337c942a0cfcdfd5be7815623401588ea745ae41188d4e34fefbd1d80e5e72d89d57005328e932bbf8b0ef4
SSDEEP 24576:KxI3Hh9ZBXfisqjnhMgeiCl7G0nehbGZpbD:KO3HhpeDmg27RnWGj
TLSH
T1E375CF1277F98035F6F32B319975C2755A7BBC61AD38C20E23912A2D9EB1A50CA34737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4272	alg.exe
976	elevation_service.exe
4984	elevation_service.exe
4144	maintenanceservice.exe
1120	OSE.EXE
2996	DiagnosticsHub.StandardCollector.Service.exe
1088	fxssvc.exe
1216	msdtc.exe
1360	PerceptionSimulationService.exe
2272	perfhost.exe
1520	locator.exe
4176	SensorDataService.exe
672	snmptrap.exe
2328	spectrum.exe
332	ssh-agent.exe
3792	TieringEngineService.exe
2580	AgentService.exe
840	vds.exe
1192	vssvc.exe
3344	wbengine.exe
1140	WmiApSrv.exe
3064	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	spectrum.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\faf21c66f6d6c89d.bin	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\DebugOut.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\DebugOut.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_169453\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7f22cef3cf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033b650ef3cf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e92d28ef3cf4dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000042e562f03cf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be2c47ef3cf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdbbd4ee3cf4dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
976	elevation_service.exe
976	elevation_service.exe
976	elevation_service.exe
976	elevation_service.exe
976	elevation_service.exe
976	elevation_service.exe
976	elevation_service.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4388	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
Token: SeDebugPrivilege	4272	alg.exe
Token: SeDebugPrivilege	4272	alg.exe
Token: SeDebugPrivilege	4272	alg.exe
Token: SeTakeOwnershipPrivilege	976	elevation_service.exe
Token: SeAuditPrivilege	1088	fxssvc.exe
Token: SeRestorePrivilege	3792	TieringEngineService.exe
Token: SeManageVolumePrivilege	3792	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2580	AgentService.exe
Token: SeBackupPrivilege	1192	vssvc.exe
Token: SeRestorePrivilege	1192	vssvc.exe
Token: SeAuditPrivilege	1192	vssvc.exe
Token: SeBackupPrivilege	3344	wbengine.exe
Token: SeRestorePrivilege	3344	wbengine.exe
Token: SeSecurityPrivilege	3344	wbengine.exe
Token: 33	3064	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3064	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3064	SearchIndexer.exe
Token: SeDebugPrivilege	976	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4388	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
4388	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
4388	2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1168	3064	SearchIndexer.exe	110
PID 3064 wrote to memory of 3980	3064	SearchIndexer.exe	111
PID 3064 wrote to memory of 4572	3064	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_ab9f97ff5b31fde05fb9add4757600a0_amadey_elex_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4388

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4556

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1216

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:672

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2328

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:220

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2580

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:840

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2864 2888 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3980
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2908 2928 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eb723c81329869292cf2cc68af208059dbc74ddd7cfd60981971409f12af6f0c
MD5 23c0f3df409ba037d03d2b8ea5447677
SHA1 7c9056e7f7a471a72051ba96ecf1d0bf747deed3
SHA512 76ea7e1f10b3d18a3bfacd2a78378d3105876be0ca11fb2b2414d20075a3b03a4800c17c16e342139e7a924f20da43bb185abf8caa1bae19bcf6ec46022f5697
SSDEEP 49152:4b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnIDmg27RnWGj:S3q6sjBLD527BWG
TLSH
T1D9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 2250eb98195d7f39168424cfcf6e58bc8e3d3f750e74945dee6ac072484c0d3f
MD5 acd524bf8bebd402dcbc939629ace2cf
SHA1 5dc44182b9b75a01e57280bbe5e40a523f209abf
SHA512 1210370013e0d92273b01cd1add7127659c52064a1ce951fb76020d5159a50f8d1418ce1f760f743e2738f3c6ddbb1970b5a12232abca4a84c29b92e8888b8fd
SSDEEP 24576:cXYfDtczATsqjnhMgeiCl7G0nehbGZpbD:btcCDmg27RnWGj
TLSH
T191650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3eaac3b1dd013af6a08410d7b1f961cf489f72e1bcbefb52cdda134ae1d3908f
MD5 686671ccddbc3c484f0ad4a1a37c2290
SHA1 96d3070eb780686e6baacf6b16c82fcd963c8d0a
SHA512 ee2bef1d8d972be62ef8f3ec32f25d72fd4b20e1fa99c6476d7003b6799a4e271d1f2c92d3138f4cead0502d19f4bb472cde25fd20833e2f7bb32697268859a4
SSDEEP 24576:N0Le5ji0hmxxrM0sqjnhMgeiCl7G0nehbGZpbD:NPji0Aj1Dmg27RnWGj
TLSH
T156859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5789f967f51835473af784545be08627d842d0274f898c9255ffc533399da3f5
MD5 516f4b7200ee4303a2ccc0da8d6b87cf
SHA1 44e9e6f19328631d3344e6e7fc43ea7199e60768
SHA512 be1f9d83970692808ab1abccf4ecb9e4518339e07889f9447b7c7f3affb70baa372f134eb34c7f68a094754613d2e93cb21c5ac79ffaeaa43cefc8ddea4829b0
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWn6q8wyuesqjnhMgeiCl7G0nehbGZpbD:i/ezSC6vUzPveHjyxDmg27RnWGj
TLSH
T15E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0ffd841fa8a5f3a9917f1429fd1e711596fdf8797cf35ccc1e944b3422d12a92
MD5 6d4918bb0a2a8502630a502cd57105d1
SHA1 58d4ed3369fa8f2945bbf8227d587a005f6a0783
SHA512 fa693d5831174b1299bc187ebd12095dfb8f864b753fbbf6a82bbfc9389f2524b72214528677cd1ff6c406178d9af9a9591b9bac8e4abc3c12c9a9f32b3bce12
SSDEEP 24576:sVbqPb88hv/l+YnsqjnhMgeiCl7G0nehbGZpbD:sVO88hXl+qDmg27RnWGj
TLSH
T1B4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0c85fa35b96376421db775efcf8b3bd4bfe37862efde268389d7005c44f83db6
MD5 80c84a32623bcc52d69ad86b79ae6a65
SHA1 a9c80c0c6d4f6dd3ca8152074cf74b537eabbe43
SHA512 96442cf26b1afeaac93bdea8c77d5aa4ec8820eef9a6af331286bd07cd6265e17cc380617a3d818d17433d1e0212692b6656c3e1a63880a996b31ca27014afb3
SSDEEP 12288:oLIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oLIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A44523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 67fde09d0aef4618ff156ec8d636e5fd5deb4d97f2be7e935a1e76a267f8aa5e
MD5 831d63c5e718caad9f0d1fed9ccc8a75
SHA1 2355c27a9f7543ea6d90e3fadfc9945d0ba68cd3
SHA512 ce9c63e92cb6e770af5fbb1319684d0322ce40a71e08907b82ed475448672886626a3ee67d9f5ec44a021828755872aceee926322c729f8d561f257c8668f4bc
SSDEEP 12288:2eBNUbTVO86UfXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:2JIUfsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B65CF7BEE28FCD2C27A4DB85791C600E77278314B61A3CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c95342f8751d6d39f9dd2feab06fb3d1e48aa2614d7027d5fefd59c8111116fc
MD5 d134cdbaa9ea1f752084df0c594fbe2b
SHA1 0ef32089afca0f1507dcf3e96f1e1e5c33e23d7d
SHA512 57777892728e105cb2b9455a3dbc236fb8aa1c999bc8fff5dc1334ca9da4c300e13fc9bf0277e710b6190ce5dcfb9fbea938bda1b643c9d5f6c4ee77873e8dbc
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THi:YQvGAdlCEL8c/DRNw5CiD527BWG
TLSH
T1B1266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4e5d55e8733b612bba51d3df6024dec01435ebae2f562f3d5fc9caf3a690f54f
MD5 df3cc79bf13cf0e1b2e931f8e665a200
SHA1 c3685b23cc70ac6cf78a60a2ce60880434140684
SHA512 b0cfef6a9bfe978f6feefb77adf7c387cd8d4e7d9c7d00e7a4667223cec905ae2e828ad27b28829ff6eaddca8701f0d89ca962cd833c396aeb198ab20f16db7c
SSDEEP 12288:BAwSfxL/2Dc3RDLLmt0LDQewsAjRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:i0ewsAjRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9e80c1d1a6a4c79bb87f40da02476e5b99ccf463332f813f27490161d738b8e8
MD5 d6cda0fa9ab8b7aecb14622c24a937dd
SHA1 94e071ee54ac218c6751cd92600f400a6666bb4d
SHA512 43445830c288760578016c95966e50ee4ee07f28ea2b838642f61006a9465262d3d86b357df88b12ac5da53c31b5fdca604069fbcf9161f81585cacb3257d8c2
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH9VQBWG:9UEtQevvqc2W1cpV2tI32IB
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a8722f90439730e215a47c051dcf68026c6cdd6f8b96a87f27fec8ddfe62c85e
MD5 ee6e9971a70abb3e7ce4ea81c1499285
SHA1 dc2eae5f4692819a80d92ebf400952dcb9ca22ed
SHA512 fb79a623f85fa048cd2eb62bac1812fb6214da8ab270ea1f693e38dbfe0ec21578817d43d8cef3737c4fb81a7ed9fd127f0f1106ba7f3fc8fe88b651c4afe88d
SSDEEP 49152:LCbRquA/m2yL5zTfFiV+XenmE3/zFDmg27RnWGj:UoquVjnm+D527BWG
TLSH
T130D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 330a1ab3488d69492adcebd4ac5b0492c6fc802f4ab81acd878b4e6d3242f2bd
MD5 0249a6fb06caf09f61b69cd8e1cbc4ed
SHA1 d8664b9a8b63fb2bb62371a3481b3b4e793158d7
SHA512 be1ea0b27fa3345a39787e96d8dff253d0be913c4b20e60a23d7ada16b21732b015bb96644bb60b75f27235b196397c9316a7787416319ae8a60c5af6b5606be
SSDEEP 24576:cAhGL3IFoiwtA5l7S53KsqjnhMgeiCl7G0nehbGZpbD:cAMUFoiq5uDmg27RnWGj
TLSH
T139359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6ea2be4ff537ac2094a4a141d3104b5466b32c06914446de974355187c2006ae
MD5 72c4d56446d7449860ad4e70d54ce662
SHA1 94a226421ef0b796ca56d5974a07043a09cd1025
SHA512 ab53cd0c9860dc5cc9a8e2caa4db667d6e10e2015b81bd41f74696e3d917b4ea15c50e1c8f07f13bd2385cb8aeb0d794ed25172e9678c9b866c99a9d3f7d959d
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+C+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:gwu4OWtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15765F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 10412cb195b7213a72e12c337da470adf92f815eb428ae8bd3596780a56f19cb
MD5 b8a55427eb00e3dad80a2e9068d45eba
SHA1 1bc4588a999e945a78b1233ee9f55d8f9b7890a9
SHA512 838e0bb770cc432f6c4b3382565066420b8da528e16afaf808d4e3627fb5f7ec1a8899609bfcad01f3ac49b6d07ac3ae0a7899aea23c9d926728842286503434
SSDEEP 12288:jeZ1IyBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yZuMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D5512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b7ff1feb9bd29e81d0dfe22f3205611c83809302abaa0ec9de46584b2b3ac77f
MD5 46f76a4b1e58f720c2ab94c0f74e17dc
SHA1 8b1fa0787af8198be1fb78e2a4a4e4c09418c537
SHA512 fac24a468cd9a075635899c3c3e82d4ed3f00df760b4a2047fbebfcaf31e78dc8ffdde63ffd6e65a96b1da4f6327163ecbcc8756adf0e655fdd2ea330b0dec66
SSDEEP 98304:YQRQyi36YOcPbLvw2gAf+PN3/D527BWG:PQyiKa/X+PNPVQBWG
TLSH
T1E1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9f6a731cc395d5f5c783abbac4a7eab8fce7486266a3e3dd6382756604ade933
MD5 42305f7b1c7a3dedb22cb8a527e28fd7
SHA1 62a4f0442ab8eff516caf1f9d790e350db866fce
SHA512 040dd66e10cb3a1e4dcd3e35885b88cf3101b4615bba91bd47a361649bc96df72db112affa07d8f23b4f48ca12f96f888b8c81312bd6a937ab72718f96cd4a67
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3/D527BWG:hQyiKa/X+PNPVQBWG
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5502c14bccb09eb53eea4889659565425412348e18459635101a99faac11b684
MD5 df5c0c8cbfbeb34158db0cf793c1138a
SHA1 62ec7c170ac18fc0f71a5f6f06acb55521391bc6
SHA512 504eb604f94e1f755ed8bd6b0568ab713c914da1b30c12585f3839fadbfc130ad119882bc9261715a4536a0b4c9b8a5abd567c709200d4ca8174d8eb2bfab447
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0csqjnhMgeiCl7Ge:I68Qg55nhceWu7PNU3/1Dmg27RnWGj
TLSH
T115B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 532c9aaf0b0b7e3703c489be1e30736be7aa272b315b9162c245e5395803a196
MD5 8c6a64dfc9950aa4f11dfc776636545a
SHA1 7b2175b1c59c8af6c021b0702ecbd57c9dfa9102
SHA512 79fd5d5d5ebe63a8f8b0812a08f5397ce27d8b7c4e9323f4266f84d9137f615b606eb09eeb78efe5ed5c082e3c4aced4eab818507fac9793a97aef63fec9b804
SSDEEP 98304:/y5112gYy5azzVvt69nLKnhZ0D527BWG:yLIHEWhWVQBWG
TLSH
T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0885dfff9654e293426aa37bc99e1f88d1f7de4b9bdeb2faefcf828ca20b6f6e
MD5 f7a8f47531fc57958d57b941860c219a
SHA1 90ffe295ebcf10e8f2bb9fabb0b021cc89e44256
SHA512 c21a91fed82693f6457624590bb2b82b995e7b02b4f8fb7187050bf0b814758c4dc7180370eb9e09b4fe08301885dfc5e8454f1243ce35fa8444dfd72c0e79cc
SSDEEP 49152:fB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnDmg27RnWGj:hu6Jmdxd2dnD527BWG
TLSH
T10DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d47a450c9cfbfed0a92424d83db96c1a41b1404ddef9e8fb537f7336786ec223
MD5 424d2bb730ef78537e883e1dc9732f54
SHA1 334ba775d8b13b9fa614ea1ac9f1e8e6d9899cdc
SHA512 5f8a803f5291ac682c1fe717aee12a93b84c045d7c6c7d0db7b6611b64ddc3c5635164ea51909b8c45d6a3f0ffa98f75b49c314d896177ee5e37d4388a745d8f
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xjDmg27RnWGj:jmifPWR+D527BWG
TLSH
T1F8B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a5ae5c818bc544ac6e25f89b98b052f3340668aa702dbf5d3a2ba760bdaa4558
MD5 ebe4a41c4e0a16931f5dec2a9801086e
SHA1 0f781b12cf501ff01b0c2e72b83466c54ed701c2
SHA512 f3df6df35b49d5cccdcc0cb27643ca21dbcf9123aaa0884744a66d388adf05bc5cc5829a18887853b20b84d507e24dadbc50687fa738e6bd0167ca1cb44b8e73
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHq4Dmg27RnWGj:a5dKii614D527BWG
TLSH
T1C3C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a6584564fabcd53f8df7e74baa497315aa99c3ca6a8e950b225206737f8731c6
MD5 9d6d0fa9a27dbdac88ddad8e870b4450
SHA1 f36653f2eb260d7778d39860593675da7b990049
SHA512 a846295d74edb51ddaff2ccb8232c1f89445f57a2e67c41d0365205654f456628e7f1d777be6f88c269d2b6c0b44ed67f60e49b5ce9713dd0b45ec7261a8ec3f
SSDEEP 49152:QhtSn8EApI0fig3giDn0AP5wXDmg27RnWGj:BX2imphaD527BWG
TLSH
T11395BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b0c1dcca5a68275069ca953da6241e104fb0e0956f71a7adb034990deee488c0
MD5 63b89c852c7fd57d68a190b1f344626f
SHA1 c54fa1a12a980785721151ae438743c5ebbec3c7
SHA512 3f5d57e03487fef59f67604eba4112facfb3463e6734c40856406c7d052d61aa5eae428a33ba507da501f00662f04032ae86d292495acfd964b459789de65689
SSDEEP 12288:GgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1614523BF965C41CAE62648B5C3E5F10DAC073E5BE92004937A6B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 aff2839f8e348ee1ccf6e30506c9c10c81eed7edd358af597cab1791729da35a
MD5 b8ad26ab297b105b493cb94561f29b46
SHA1 f36b87a429da8fe18eff8caee9ef6712d1674746
SHA512 68ff69192e02b0c2b60c2efabb0e6ffae596a561c761da115c880c42e58790e94331909b8d9a7b8b050796dd9c1ad20e4fbdf75f4a66f9bef2a3431a6b2038d1
SSDEEP 12288:lVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BF965C41CBE62644B5C3E5F10DAC073E5BE92004937AA77CBAF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 32ed179b9bc59984cb71bd70d1614f05213853645454cfb7a0d71b7de05fbf79
MD5 d269574e554cdc45fe071fee45e95eca
SHA1 c56f38e736232f09eaf792a7d1a1bc4bec9c8d1f
SHA512 c2617f75957d5563acef50b1ac857017202f898c595a0f656c4dfce0e89e3efe976e3a614088ee55c6e8b3d25ae8630fc1edb5a1be6e7ef1e32eb7b2942c448a
SSDEEP 12288:P3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:P3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CBE52648B5C3E5F10DAC173E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 98bd997c5c469cce6b4170a44be92bd3a80baff8ab3c1d8b559f91d34d9c732d
MD5 7e0b4429a517e15843ce9c08c09d2a91
SHA1 77a50a11d2f6e7e780894b5f9f23f8673bbfc7bf
SHA512 3a8a2b0cb429f08a549cffdfa3181a97e9a2972a368bd9cab25a07232ee29cf9158f2ba5513d04fe837e0247e7eba791bdc7ca61b8cbea8f14e9a34d9d615c3a
SSDEEP 12288:HVqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF45237B675C00C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE6FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e68dd02d4a2d89292522eb304152143490c0168bf80f00116caf744aa4313ffc
MD5 8a008b09b80e9ca9a2c6f2a5286a014a
SHA1 1332ffc1d8d43931cb5e1f3b56677687191730e3
SHA512 2faf11780eda4e860ef3702352a2b2137b83f4b629caeb1fb2bdf784ccbdb53492f3df76f0870a7b7691bf2ddba32cab5d696b2b823afa11d28995fd62b819d3
SSDEEP 12288:kyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1874523BF965C41CBE52608B5C3E5E14DAC073E5BE92004837A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8f5cac535cfee72999ab258def891c6717c157bbc03a20711a063505dd5a1831
MD5 e27904184194fadd57e857dd2f19d55c
SHA1 2d3a04d24853fd8a7ddd00349e170e7ddceece35
SHA512 b18d2d67efa98c9ccc0c5aed85192aabcd71b41566f9e54e5eaa2da4087a69ec1fbae700a97cffaf919bbddfbd57f318fd203df5396063ae4d879ca343721fe2
SSDEEP 12288:1pXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1psqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAF7B14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0dfe2aa527413b256210026f678c5e1000cbf622b5b81717709c8d55fa121484
MD5 47be3ef9f387e976320343b4696c32d3
SHA1 162868d68675898c24546894a1ce369afa14373c
SHA512 14963834441dce864136f18fb30bddf92063d3870400284ab912c3ffe0808e0cc68153e75519d047723feeeeb44573ebf084e03dddc923c45f9f663946479484
SSDEEP 12288:q9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF4523BE965C41CBE62604B5C3E5F11DAC073E5BE92004937A6BBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d9a3397639272364c5f6518a088bcb2b258f645fe84973e3ad6861b29ab9ba94
MD5 b3be459980686a7dee0b0a1dad9b853e
SHA1 833691891bba78d6f987f4805f103bf3606b4bb5
SHA512 a3123ea0e62c14a044b90a0b36239f3fd1f81771ca090645c6353c7b8e3c6b4d3f7256d309b76871cee0537ffcae0d0ad51ac974a62df99b1bab98816d7c906f
SSDEEP 24576:EZMRzFVSO1sqjnhMgeiCl7G0nehbGZpbD:EZMRzfdDmg27RnWGj
TLSH
T1956501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 903d47be874a8caf5f54a1d0d16a6ebe7a7ff761708d548f3268435ac885cb1f
MD5 4ab5e7cd6a33831efc9b99ee4e0f4b92
SHA1 c9b7df3d968306b74157d55432c8b4c48b253f3d
SHA512 aaea7319e14f5a08ed9c380c09396873e4de721f1e6ab0cd44c6c99d5dc6e47579b510471be3cde1bf86271c4d2d52731b361593e3f3ff71d4aeecc4ab74efc5
SSDEEP 12288:r8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF965C41CAE62604B5C3E5F15DAC073E5BE92004837AAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 92aca88f8dff175ac0459824c54bbf32e1c3c575a1e8f1d85e082a6ec133aebd
MD5 d2afb1eb854f2fd7f596b5f3fac2f1e8
SHA1 9d093c1550a5d5ea41d31c3b743c544e5418dd7d
SHA512 f573c58f73903f3ab222b8eff6274938bffa43118cfdbad0e7d5a3fb416e51e43ab9f8c81ea29a824f2c446bb3787b0fb1c6b815b5be150397c0753ad3551b99
SSDEEP 12288:j4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:j4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE4523BF965C41CAE62604B5C3E5E11DAC173E6BE92004837A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d1dc9559bfe3c9616eaec99fe0f23c9a8cb28df7f748e78d1973de816fd8a649
MD5 0e8599cbaa8163f73731258fd3bb8d27
SHA1 c15413c786b7c35b6396a81ca47ac4f9317ec0a9
SHA512 4c119b57e0d573666dacfa73643267ca22a30e4e1ecfc4662f0b1cc72cd70c5fce80e3183970d5c9cd3d769dbf587be15e2ca5e01fa9c0fc4bcbb25b2f597611
SSDEEP 12288:dyPz5L8BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2065b3e81235ec1b05bf3a644aca9909d9725583bec811a62330fa604928d0be
MD5 cbebf2a7d250f6d9459583ce89719ceb
SHA1 9b08f7a42c563cf4fb28a6e7be63d100f1e039a1
SHA512 aefd0e387c432d035427372b63d422f493851a2ffaa1cc742e9d62dff66c83a5c8053bf7105e7cc20e768a954002bf052e3a1cc6861bd9d98b5a42987ffbb28d
SSDEEP 12288:88Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:88sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BF965C41CAE62604B5C3E5F15DAC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7083fe3bed94fb6c047eae82ad5bbda5fac4d046468022db010600e0dc159542
MD5 3c91d393400ba19a39843f6a6a01de18
SHA1 de4422c9086516dff8aa909e5f9d70728759f5a7
SHA512 95defe2038d40e12c9c59a8390d2a1560c91ad9a21089629112acdcd97765c0515f05a494a9f13430573690c01e80fe04ecb598690a4a0297dd02f336934d2c3
SSDEEP 12288:M8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:M8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF965C41CAE52608B5C3E5F15DAC073E5BE92004837AAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7fda433c607096eb7a735c4875d8dee1423944b2c2734a2677a0417536db4716
MD5 976aee0c9b3e60e888fb68a657a4e7b9
SHA1 d913061c9e6befd1a2200ba09b6f5c5c49b7d960
SHA512 4b1a3dfd81e59ecc3700547871412b522a15f54b8eef415a0a403394af0742354f71f9837abb9c7c4840386bfc59a06aac7362059c08c8e6cdc1f797912fc696
SSDEEP 12288:4yPz5L8BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZzyBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C055125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 228bf36589c79fac067177954af0ccfb93e2951278a1bf3ef0a986307cd6c96e
MD5 a8a1e40467d6f1999d19c0b72d9caa22
SHA1 c14f4a254a4c532d7a18f874c76aeb9f2b2c4d1e
SHA512 7b3ec81675b49081a6a91346b067bd8dcbb3244eef2826f5b0d59f3907f2e64f21681d79d1a81bb6261a2e97bd66cdeb6ccaac5f4805f71a830ce8720ec28369
SSDEEP 24576:9TDaLl3z0zDHsqjnhMgeiCl7G0nehbGZpbD:9TuLljyDmg27RnWGj
TLSH
T1CA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 10af2eec1982e1745b99e71452706589556ed01c117a306ceca43777e27802ef
MD5 5c8f4ccb6612bb9aa10e075ad6c47e22
SHA1 f77e9d8517024ac576c0591982da653cc49f50e9
SHA512 9c10f8aa998e62d1ea9f201969d03a0deff02bb5340021c1a66989068ddc183ae448190b1b7ee7b3f3a41dd0616a4cb426f4b370c4cc1e43fdc41d5ab976d6ab
SSDEEP 24576:l3vd9CHKy7GZrsqjnhMgeiCl7G0nehbGZpbD:Fvd9CHKyadDmg27RnWGj
TLSH
T1CF75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f26c8c6974d06a177a8af7d7c9018343955b431e061cdbde7c3cc316fff27f6b
MD5 4316b63fd2cbd284704e8aca4e8574b7
SHA1 1fdbf4e131a6b1b6c0b3a4abe42b584ec4a6c1ba
SHA512 1506efe967030ce4405cc9be1c41c8a7b5b3b0ec0a66eecd942023ed6375ec4434d8423b255b84c5469fd0e59dc74a866ed7b884beca53676c6ce089a076e0d4
SSDEEP 12288:uXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B24523BE965C41CAE52608B5C3E5F14DAC073E5BE92004937A9B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 de167d2eb772b0e0c74bc4ea220ef6ba907c6dd8aa91d712c7f948fc35ccba39
MD5 b8be3f140e4dc73233aa2a396fcc5943
SHA1 ce19d2ef75a8e48dd957beecb1930b8344542dcf
SHA512 9fc2df94eafabd600e3ed0d71ec515b4e35fd71cf9722e1d01c2f60c7a9d00efb8e7c2b9951e332d8a643eacd1d86412f0aa6772a0d9270d5e034ae3a92b0b13
SSDEEP 12288:chXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:chsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE965C41DBE52644F5C3E9E10DAC073E5BE92004937BA77CBAEBB14584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0b32c89499083f0c5749bb1700fe6836bd54d72ed24361c1fdad9e0768e562c4
MD5 df6e9a974a4323adeec4f23061dc88f4
SHA1 c64c3c998004d0cfca6029d01b600a0974ca3e78
SHA512 9cee41104378d0e2bec47b46287edfec74f2344c3192772bb5919a3a90bf06f2075ffc04bac49f625b712a0a47527e3de606d909833260c7002a8f6a87200105
SSDEEP 12288:QGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF965C41CAE52608B5C3E5F11DAC173E5BE92004837AAB7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9b1efcaf1bbc883c542dd1fc4bcaf550f4ca0573a038d3719925dd5ea7420ee0
MD5 5d4978c9d5d7596e2049b7c3df49db51
SHA1 60f8269838bff32cf22dc5751cae62c72f353fd1
SHA512 fdc5a300b55fe6802bd02af1a7f1ca4958aa4279796abe123d7ae154a9e45e2e49f1a46d639876bc7e382832853e080cad39f64ed0e70ac82902c051e959ed22
SSDEEP 12288:FbsfMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8c5a0aa0ae2e239aea6251478847a623520641cc7ee34a6e138960e09805b347
MD5 ba593218a1aa1bc5951d617ed16bdb09
SHA1 b56c8dc0733d9eb6d35ad9cf36c128e16e8a8039
SHA512 decac8c4a16de7732fd9db30a7b1fcb7852a038741910eb618504ec727a8b20e7d0edb2214e452c33a1eed49a14f145b0209e97c6ddbed0f3a11e545e4f3d2f6
SSDEEP 12288:ucXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ucsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15345237AD34C518AE97609B482EAF12D681B7E669F2004C3B94378FDF6B18D48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 639371e6e612d6ff9babb5390d741f7bfbc1ed88c0d6887a65b1a7c590ac3402
MD5 33d41ad378ac30fe57429eb92e962771
SHA1 3d13361e2bc3a158924ba66c3c3e32d783e439c0
SHA512 1aaad9038c2e4e8d2f33877e917c8cadf503e45e8d81ab31c6a3ac69ad86f916046a7ce14ea64d36d7422d4912585b52777124131a845afdfb1649daa6e4ea1f
SSDEEP 24576:j8RMyNoSFw1d+rC4vrmRcGPiQEaiPnMRTCesqjnhMgeiCl7G0nehbGZpbD:QRZwQCyiHiQEaiPnMrDmg27RnWGj
TLSH
T1E985B01E62DC42A5E0BAD278CDA78407E6B27816573197CF1291C27D1F27DF48E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 18334178f3037697521190f7032b0312590bb4782c21c337662e78a8f85f9e65
MD5 2603537d01062208ec6361d48795cf07
SHA1 3f8bc5dc6b1caf86f275885e12993744aaf64585
SHA512 5bc1003cb7fe8fc4680b04b3b2cac6d0db0bad4252559fc3ab9f3047008ddb16ee1a7439dda7c0ff0515cf645b4105d6747a394f0513bf08ec44d14518581577
SSDEEP 12288:5bxA1U7KMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5bxA1UGMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18355123E62AC20E5E176957D86D2C10AD7327C26672053DF21D282BE5F37EE84D39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 ccf935acd9a50318b0dba53eea263066161628a1c087139116c36b24d81136b1
MD5 2e771d2d6158f2d81049391d6d3c4674
SHA1 dbcfc39b97d829905012ab4086ce8f6a77c49eb6
SHA512 f13a80fc6574c7f4a702b98294587c1e61360fa1f5105f843031f246b67b8f7bb366fff94a465227ca2e2284a6899ae8fda418d1881ad7cb3ca1b6af91dec2a8
SSDEEP 24576:4jsmP0yHaqrVqHra44KDzMsrn1sqjnhMgeiCl7G0nehbGZpbD:4jRP0yHfVqzlAsrnpDmg27RnWGj
TLSH
T1AE45AF2EF2B910F9D4AAD136454147B5BB71782D1F209AC70170C634AF0AEE89F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5d125760651062ac1570d97ef5596a7ecb9fb63ff8204009d71169b17594672e
MD5 4651f9c0e3a1c69c3e47009a45309af2
SHA1 2922d53ca022354a0e018d07b38c269f159ca096
SHA512 3209f9f69ffae09ff5c4f71964c2812718855670480cbd02c2f1dbfa1a0e061ae20d6c870991a8b657ccd88993755e528fa954686e226fedc7d3f71b223708b0
SSDEEP 12288:EWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE924C51CAE93649B5C3E9E11DA8073E269B2004D379977CFEE7B54D84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 316188cc5f1e2c9475b9b6aca07b63e4fec93fe3c7f9f90826db1f342cb3ad07
MD5 689f77c128ecbd75745f03d8937f3d8c
SHA1 c7aaa821541e88e52638359dd5052ddf4bcfbb55
SHA512 6c244cc7ef7817df5540046bee5b08ba09e539b05595ace948a211945e0b870b792a1ba1f9e8978e4a4b34fe479f8e028454bd552d43ca42e3e91f650ac3d9b8
SSDEEP 12288:gObfA4LWO+vAYFTwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:dbLBUTwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T150750159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b9f0d9f6c295ba3064db45ccedeed94bda6ed78331b11f3edab3c5d55b3a041e
MD5 3521a8264d01c7634d4df6d3dd28989c
SHA1 c85eddb11da3f0add664f14bba948611925fa1f5
SHA512 2ba9393420998196398db0edfa32cd214083f709f48d154da15c951b9b51972bdbdebadc10b30f4ed6e0720ad359c4023b09b4da34fd14169de3af846f2ac850
SSDEEP 12288:470Vm9IYNvUyBpbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:1pYNH5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A065E12FA2AC18E5E53B9179CAC2C209F5737866171192CF15B082BE1F17EE8BD39741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e535d586bf52500342f02cdef542da8f58eb405a701e9d486c0bb33ba86d179
MD5 1865f12d901a5a3c4b6168e14f7e4336
SHA1 a0c30676ef51d4cb290b2212a0e588a824752811
SHA512 69a3b8a42985f117e4cca6c64335e02fe4c1ca82bd20621f73569e5f9a438a3ffb8b8c3bff84cfaa87329c53b8a15c6e3be1efad913d25749ddebb6f2e721bb2
SSDEEP 24576:MnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKB:MnXoJJYH84VVS6AmEOJas+cHBjSSKHP1
TLSH
T12365BF6EA2BC04D8D5BBD17DC5C28506F5B278621331C6CF026182BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55ac5e9d2e4b685eb05779a7f30fc7a77b7b98a38d35adc5b7c5e1988c3a7b57
MD5 49b5358831fe0eebec4b083d3fb53555
SHA1 5aa056904691391990e6973031238e6a7a4744e9
SHA512 57f8c20606c89158d3486610c16252fdf9a0959dcfea4824a3e3beda54c0e85ecc668781ffadd31c5f27c1d12bc596c239fe9e624bc1c775e48c86bba7390716
SSDEEP 24576:bv7Xbxd9Tuycf8M/TYlSuxrr2PCTsqjnhMgeiCl7G0nehbGZpbD:bDLL9TuJ0M/TYj2P6Dmg27RnWGj
TLSH
T1F6858D5EA2EC42D8E07BD6BD85B79046FAB2B855173081CF1251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 ce4afa3c738f979e9cdae1d3244432cd189cb81e2de794ab503c3548440dbf73
MD5 f854bac19be90c7c54dff4a6e8029e75
SHA1 87d93817e950a85609581776835da762870f5642
SHA512 a668a265fd6d2803e49c6e6645cff26ff3d8a15d7177cb6454a2e63728f53af9f1ab7f0c1e0b6b6fab2c0a0377342bddae62f044be09f97c0ceb1849025248ac
SSDEEP 24576:uegJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wwsqjnhMgeiCl7G0nehbGZpbD:ungOJOmPOHzsDmg27RnWGj
TLSH
T10255CF3FA7BC15D5E03EC17DCA928916F6B1782603255ACF05A0827E5F1BEE42E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 16e8dc3ecabc162481194cfbcad69fe5983e59a7399e9acab471fa447087bcaa
MD5 49701cc3bdd6fa2cbc19b34537360b9b
SHA1 1782d5871e2500cc6afa3f5f394ff26b74137a17
SHA512 8a35744f4012f9297a8615778a73572b137df212668d938b1d03a68c6850257db9a160b0e57cd55e1b3ca49be5c964482f12a3e70e38f177e3a5ebeca47396e2
SSDEEP 24576:7LJnJiTk3R3waE4JrO2sqjnhMgeiCl7G0nehbGZpbD:7LJnJK8R304l5Dmg27RnWGj
TLSH
T1A175E13DD2A810E8D477C2B4825A5756FE32387D2B2169CB29B4D4353F12FE09A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4f80b74572c479ec127934f41a6da8d906ebdfdb7703f653e6b2807d8d9953fe
MD5 ee2476c0717f6ff30f3675aaa3606085
SHA1 c19f8e812640e781ce8a609ad5684bf03dc18a3e
SHA512 01031dc96cc628f507e2a28738eb0e9708dc6fdad3b8ac83f69b26e25b620fb65fae3380ad8b3bffcddf854fa4e3dd6820e77b08f8ae68c4f1d3ea835db8a66b
SSDEEP 49152:y9mqCzDScAZmlvTcFg8Ph6mDmg27RnWGj:UdD527BWG
TLSH
T130955C15F7EB5298E8B3CAF1C96694159A337C409B34F7EF0A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 f7349b671bd34a8947e17e64ba2e737cb3e8f4b61e8c7e281c14e4dcf80077fd
MD5 65c2d6d02faea1c109b9303d506a25aa
SHA1 adf4dda51f24076754092c8c5f0b88f7f3bebbda
SHA512 cad792467439c6b0b8aa8eaddfcb464054ccf2a6d85051fc723a05168949105bec55d597f328d3cdbad68742216a86059dc72c5fe42eb665628d8c643b822c49
SSDEEP 24576:+lYJeXm5jUuEhsqjnhMgeiCl7G0nehbGZpbD:+lYJeXmRUuE1Dmg27RnWGj
TLSH
T1A655126E669C30E5E13A8079C2E2C508E633B876571017EF66E0D5BE9F679E40F38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 347fe6e8d06e7b84038891b261cde205dba04e06a3f56f66d388e25e753235e7
MD5 59ad032cb3e7d7d5afd336b201851b74
SHA1 8872d9ff2a86cbd0f65ab6c6c603e961e4d990ab
SHA512 a1868b5aa02f3d170da1682f73b92662f9ef6a3a3f43e98a249ebfc51f92bfa70e48d7e80f8146e4441117df50a615344c0d6ccda5cb966689e242ebb2883ea0
SSDEEP 12288:Jmu6kyVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:J7tyVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA552219639860D9EA760978C6B3C158DD367C219F2002DF65E1FA3FAF726D48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 1cc4e585dc5b4edd81e78ab1c7a8024f823628ab9d2bd6107ea7e3009f4aeb77
MD5 f55bc1dc8bb4ee93fcc9107b3d2e5b4b
SHA1 751f276e9cfa8b223b51c1a34a4bd0085c545ef4
SHA512 10a1e0cf02905207415c513bff67f74baad96fd24a23df1a0cb14a7f41bb7b01d7193d6b876088a0724d07ad4c625b00450c664d2650ce6bb9105360283454f7
SSDEEP 12288:tPwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FD45237E525C61CAD93244B4C2A5E10DA8173E76AB2014E779E3FCBDEBB64D44B38C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 803a4be110bd21425050e40769b4df7f4b82d124214ff1fdc364b299650d0c08
MD5 0f4c260ea1d6f8bd3657b34507958e77
SHA1 64eca564553a718a8e79859e199109a1ebb55150
SHA512 052c0567f5a89758667e939f21eb7519bf269c1162d14017292bae4b267441922943421e0f01a676a0525883f8f5ee710c40f834ec98bde1db914a638a6e6f43
SSDEEP 24576:KC+TyQIu93VAumZr7jmPsqjnhMgeiCl7G0nehbGZpbD:K/TfIq+YzDmg27RnWGj
TLSH
T173558D2DA7E919CAE276C575C9A34493E933B872137186CF2044C07D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 5407ef700d3f35a845f81e954ae2e6f26a7e6c6812f38f31835a605c5850025f
MD5 aeec90121cd945a0e833f942ba548e1a
SHA1 54f8b6789b0d76e00f13a8d79b195c605acb61a9
SHA512 eb34f3b9a1d001e53c2db8bf1febde83b6b393350ac7375ed22ace8ea4283f154e50b343b09b928bc7adf95d7d4ca0bf678d1225b6a7d82e23a64f64aa20525c
SSDEEP 12288:0cyrWOstaa3kcsUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:hLQikZUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14965F11FB3AE0095E0A7813CC8858116FA737835571167DF06A1CBBD5BA75E8BE38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ee87bd0e1d30c5d154b82378944c83376ab3ee267c2d9ac33e460526b4d43e9f
MD5 78e6735c96df98d977dfca8442704084
SHA1 2cb6f24c74fdcc735ad9e66f4d938f2a9ed89069
SHA512 f526b6efc6b4b226334dc7b56f5df0dbb606f8178cb56af8147eed6aad5c100759b7fdf899c0baf4511a87b51f483604045b151d0d25ded771cab7a61c8162c7
SSDEEP 49152:hpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPJDmg27RnWm:ypC7b4+80GTkeD527BWG
TLSH
T1C8A57C3DE2B810ADD8AAC375C5461665EE71382E3F2015DB11B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8e2dd6fcf30e6169e356b2480f5907fa9158f53bd5756e6d293e8ef66cce08e5
MD5 56c6ec7503a4a3ca813d8290c1531e87
SHA1 ed64a8326dbb40189b5885fc479c396a5f68157d
SHA512 5166610d3d598bacc2462a66327f10833cd6f1f604239cf6b83a93b19e035091f44c14f841da4d6bd4c0aef5b599b0c2502e8f4502ef9740280ddc8e34b9b4d9
SSDEEP 24576:KSAwJPE1IDAo+4Kt+l4413JUQosqjnhMgeiCl7G0nehbGZpbD:KqPCIo4Kol4vQUDmg27RnWGj
TLSH
T12555BF2AA7F956E5E17ACBB4C663C601FB733822133163CF5290857E0E169E85E39F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-335-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/332-341-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/332-343-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/332-512-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/672-510-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/672-312-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/672-318-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/672-320-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/840-514-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/840-386-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/840-383-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/840-377-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/976-36-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/976-226-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/976-28-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/976-37-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/1088-245-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1088-246-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1088-252-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1088-255-0x0000000000F20000-0x0000000000F80000-memory.dmp

Download

memory/1088-257-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/1120-66-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1120-228-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1120-72-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/1120-74-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1140-472-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1140-521-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/1140-418-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1192-389-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1192-518-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1192-398-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/1192-395-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1216-261-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1216-385-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1216-260-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/1216-267-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/1360-278-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1360-272-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1360-397-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1360-280-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1520-297-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1520-471-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1520-294-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1520-288-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2272-283-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2272-409-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2328-329-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2328-331-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2328-511-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/2580-371-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2580-363-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2580-373-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2580-369-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/2580-375-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2996-355-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2996-240-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2996-242-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2996-234-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/3064-473-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3064-520-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3064-423-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3064-505-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3064-489-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3064-470-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3064-429-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3344-469-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3344-519-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3344-407-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3344-401-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3792-353-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3792-356-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3792-347-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/3792-513-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3980-538-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-528-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-525-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-541-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-526-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-540-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-529-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-533-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-534-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-535-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-536-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-531-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-537-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-524-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-539-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-530-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-532-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/3980-527-0x000001F54B240000-0x000001F54B250000-memory.dmp

Download

memory/4144-52-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4144-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4144-59-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4144-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4144-63-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4176-306-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/4176-507-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4176-300-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/4176-515-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/4176-517-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4176-308-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4272-201-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4272-12-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4272-20-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4272-18-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4388-2-0x0000000000D10000-0x0000000000D77000-memory.dmp

Download

memory/4388-8-0x0000000000D10000-0x0000000000D77000-memory.dmp

Download

memory/4388-25-0x0000000000400000-0x000000000062C000-memory.dmp

Download

memory/4388-0-0x0000000000400000-0x000000000062C000-memory.dmp

Download

memory/4984-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4984-49-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4984-40-0x00000000009F0000-0x0000000000A50000-memory.dmp

Download

memory/4984-227-0x0000000140000000-0x00000001402D4000-memory.dmp

Download