26b9d2a43f266442cb6b381f2c0de287132095f0fcf00f26e5ddfd1cb1e504ce

Analysis

max time kernel
139s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Size 769KB
Sample260708-flratsbs9z
SHA256 26b9d2a43f266442cb6b381f2c0de287132095f0fcf00f26e5ddfd1cb1e504ce
MD5 1a7ebab856efd06ccd1719d539ffe843
SHA1 6af40ed12bf168dd3be2bf9204f62e4571aba39c
SHA512 6ad80e7eceaa2128993246fc4b5e63bc4198a1f3acd08f9b6e0efc0b5d187628e87338db1dfe15ee1cedcf4d0590c6f37be68b0c8183cf4a4348fd85c720124d
SSDEEP 24576:Yd6edvCAUTeXp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:YR9CPTIWS1SZBnHTAsi
TLSH
T1C5F41220E180C472E557043155B8CD606ABB7E3A9970450F3BEC7A7E1F733E94A69B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 19 IoCs

pid	Process
4780	alg.exe
5856	elevation_service.exe
2376	elevation_service.exe
4112	maintenanceservice.exe
556	OSE.EXE
5140	GameInputSvc.exe
6064	GameInputSvc.exe
3284	msdtc.exe
5804	PerceptionSimulationService.exe
4332	perfhost.exe
4616	ReFsDedupSvc.exe
1976	locator.exe
3900	SensorDataService.exe
4536	snmptrap.exe
1272	ssh-agent.exe
2736	TieringEngineService.exe
5320	AgentService.exe
5092	vds.exe
5072	vssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e31d09e6d8ede1e.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128406\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{AC248787-598C-464A-BBFD-E6A155877B74}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{264B27DB-ACE8-4A77-B0D1-07B1A1222694}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5796	explorer.exe
5796	explorer.exe
6064	GameInputSvc.exe
6064	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2636	2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeShutdownPrivilege	5796	explorer.exe
Token: SeCreatePagefilePrivilege	5796	explorer.exe
Token: SeDebugPrivilege	4780	alg.exe
Token: SeDebugPrivilege	4780	alg.exe
Token: SeTakeOwnershipPrivilege	5856	elevation_service.exe
Token: SeTcbPrivilege	5140	GameInputSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2736	TieringEngineService.exe
Token: SeManageVolumePrivilege	2736	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5320	AgentService.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4520	sihost.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe
5796	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3624	StartMenuExperienceHost.exe
5796	explorer.exe
1704	SearchHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 5796	4520	sihost.exe	99
PID 5140 wrote to memory of 6064	5140	GameInputSvc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_1a7ebab856efd06ccd1719d539ffe843_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4112

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1524

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5796

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3624

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1704

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4332

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3900

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5092

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:5072

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5180

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3208

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 29e88b1dfb9cba0cc01317ce77c09d4b1438def9523b866895340638ca00e248
MD5 fc0dde7314fea2e9a23ecf05773153f3
SHA1 25c026a397c5016238c60fb1108a39eb86975eef
SHA512 ac867bfa81c1e07429add84fafdc631ad5cfedecf94b2c2cfbe9d3b82fe19fe481f1470d3556698b39d3bb196e066da01ee05e378843e1ac9002a34f9315f7f7
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnYWS1SZBnHTAsi:/3q6gjBncNzAz
TLSH
T116D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 682cc3f58b24f0d538c3d1bf26d80db674031db8ff0c7d872dd5942b7bb0a495
MD5 11e572977b2e8f2653336e8453bac100
SHA1 3aeeb4fa35c4090300ef6d2e8dda01df004444eb
SHA512 4c0b5763fb5bcbd8bc31be7e9c8e3e68448c80a84d725b57630c0fdf0fcdc8a38c4ea215267004ec58867a9dcae29c11282e79f4dfe15514e695f8acc985b9d8
SSDEEP 24576:6XYhztczAv/p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Ltc6WS1SZBnHTAsi
TLSH
T1EC05F128A7E009F9EC974239D9A18405FB73B8518764E74F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0cb935cefeb75a0766903d8fa2da0796ad436525d5c724f6c8d7ab6cddd1be07
MD5 8cfabac44118f6d316fdb1daa0824ab2
SHA1 a01dfa1e14fef1c858d24bb309bdde07e6171c68
SHA512 5e9449fd367e2fec04071fcdfaa6e8c4b1251c31c7b317ea81b51ceb2c1903cce794bcef4bb03822ebdd205b2c8c609f609af852fb98be382dbd435afbf16e71
SSDEEP 24576:T03eFFU0hQxOrMcp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:TrFU0CodWS1SZBnHTAsi
TLSH
T16B459E15F6748735D073C0B9C5D2A68EEA7230825B308ACB4286D77C7F676E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c4272c132d9d8101d264c0a969b1d17c4028004d2d665a27128061eafbdd0a3c
MD5 5a7bddd05435e8644c89678df97ed856
SHA1 a4e4f7eae6def5b755ca566b0901c5b8e85d965e
SHA512 27b86ea7c232932f9519eff145b9c98d81b3889fc6254c21792b1b5c70963460adedb50ed9b77a9d503aeea8804114f406d2a8c075ea6c4d1946ac86cc915509
SSDEEP 24576:ja4/ezSC6vUyD/aqgrvW/6q8wyuHp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:l/ezSC6vUzPvuHjysWS1SZBnHTAsi
TLSH
T1CD755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 099617ee95698648396a6141cc122604a8a1855e3772df71076c82696f7665ea
MD5 4db0ed02f0d10b3b29ce8a0f4da2b73b
SHA1 ed558ab46512b9338761f9cc2917cb34654b1d0e
SHA512 6b052b69720b398c6887c07bd06bb76683e2649ea27c612ecc654f0a70b4164679b001cf495d5c9d84af9229e2eba6a5090cf1f81bcdfb6e89a37af983c8700d
SSDEEP 24576:aAbEPr8Fvv/l+dtp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:aA88FvXl+fWS1SZBnHTAsi
TLSH
T144559E66F5748331D073C0BAC5D2AA9AEE7230425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 8a26d30e9ce45e8ec7c12a2e2c5366688760ca7a2d521b8bb97879599ea8e527
MD5 08e2fcac33ddbd2c2f2e79442f66a90b
SHA1 9d07dcd99c9377b2911e9983e3d2924b7960f5fa
SHA512 4fb91aeff46881213d2bcd1dcbbb30c5e13cf7de19b01c098023cf7a87b1f890ddd401e46cd12f75c8dcf97620ef7d7f340ad59a6bf7056858613445e5418b44
SSDEEP 12288:+ffp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+ffp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T13DD42349CE608E60F6C40A31357C4C4DBBF79761CC6E0B0D06A8BA4E6A762DDDEA6543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 bb8fde78616c8d9a511fd6129b7b7f44601e17793e90984c5ef5a44bcfb5d9f6
MD5 919f457ab63fe7d9da06bf03532bdcad
SHA1 94a7c8fc66445d8281db4e87b59ed32428d35a28
SHA512 c33f4da00bf389aa8f5227c2ea30b552cd1e1821efc527b165dfa903cdcecc362410970411ea45ef51cf762d6f759065e936cf0e573409b0230eeb7df885210f
SSDEEP 12288:PeBNUbTVO86Uxp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mT:PJIUxp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T19515CF3BEE28ECE1C27A4D795A518600E7B274304F6293CBD175830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 435f1ced1c6562bf34f02a088f1401aa9d77ab35da70e4fec99ca87671c47d2f
MD5 7cece49693b181b67be0fcaef8282e8a
SHA1 b631392aece53825c9cfcb51ec7216755752b1e5
SHA512 a644a200b48a1bec34b653b8f2b520c0ce20acf3351eb09806533b58b92c2449c4167f06ff43df5dddc7d63da8707810e38e265e74b5cca4258482c3fc946d4f
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJx9DN5J+NRV3THH:5QvGAdlCEL8c/xRNa5CecNzAz
TLSH
T1D8367D656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 e24b23db0980a2c9166ac7be60a7309a503182a4de5c891b7e1e05252fd4bc3c
MD5 55d0bdeee2e254bf204e54259571769e
SHA1 18b3db98cc851284ca3cdccbb7981440dc490379
SHA512 b85c2410abb8f28ae963df946bb41be50dc33cc27bc1e6f0c165114d2be78712d6f73de85afc8168c27da9c90cf8d6ac727cc19b1045c60e023b1b973a9fd04b
SSDEEP 24576:BmewsAjJp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:kljJWS1SZBnHTAsi
TLSH
T17F15E031EE74D436C6BB0D722B35C70A647D7A204F611AC7E3E89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb1ea5b65bb7b73bace057602dc099e121415fadf60109b4c95ef3691269b0e2
MD5 26d545d3ff804f74545ef98f7270be5c
SHA1 f8ed930ed1c03addabc896e851b26cfdaa4dd44e
SHA512 a6e9506b6117dbd111e16a86522fb28f13faf5bbff925f0231deea26010159ede441db69327e23ace76fc0ce2336b9a7dda8101fc268523cd602a658ce5ab5c6
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrndPlbuJH3Tz:DUEtQevvqc2W1cpV2Xr92Dz
TLSH
T116474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9dd2d3cc79e50a2b6d36f51a141a7b46cf4f9cdd69f0b184c138ab27ab729a51
MD5 1db2132f5133fda31a263866b1b49ace
SHA1 43066d7000ecdacd1bc493702ae3f1c065b7c1f9
SHA512 376a560d64b4b7c35f5389d4d405c9ddbb51100550f0017c1cb23d823798f5235bcf4d9337568eb25c5cf6c6ae59a1f169fe057708e25389892bee5f577015a8
SSDEEP 49152:okbRquA/m2yL5zMfFiV+XenmE3/zsWS1SZBnHTAsi:boq1Vjnm/cNzAz
TLSH
T145D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b06c1977c1e879715ed96a3a05ba9c00bfaa39a9bfcfd506ad37f82d7fa5ec67
MD5 6bb40186c9cd868b45eb4a0da4ce0b91
SHA1 a4c6a55be3944aac52f232e0d113abc0197832f2
SHA512 e3eb08ed6e782e3a4b70372d27639485718c58b81a5ec6319aefb526d80d79fc8d25aac125aee64bc73b7cacd9ea5b0804e736252ec591f3f223a8431d22891e
SSDEEP 24576:bAhGLvZFoiwtA5l7S53Xp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:bAMNFoiq5nWS1SZBnHTAsi
TLSH
T16E45AD81EBF945D4F5F3AA78A9B58471EA76BCA65E31C20F2160D10F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 bddb467acdcc88e7890192d0a5294b0c74da89f13d04707aa94843fe61d1b691
MD5 1d7de8d33ce7c6e0b670e1a5bc62a520
SHA1 589636f9316744afcc985c4343682ba5a8382cf2
SHA512 140ca11c0057acbb3cfcc3ffd12b50f6b05d3bfe2d88857b4b9313ed3a98304e9e4a05074b79c1480a5620bb4e6b309ab7eb6bc5fa4d857a191636c8d838a2f3
SSDEEP 24576:UwusOW4p8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOTWS1SZBnHTAs
TLSH
T1B305F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75B6F33365AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 02db2865301ea20177f870ddef22061b7be9fc362b39ae7fde4945a797b78b0e
MD5 494c3157fe68341bc4d0f1fe7f317f7b
SHA1 d2c01535463565d14e8d769943b78197a3e6172c
SHA512 131980a5447e0bcf510e3d2bf715a91e7c538bdf33a3ce6e294177fb0736cdd717d4fa6f24eaaf2c0b2f40eec1431961c6aba77c414cb64122dc0dce5627459c
SSDEEP 12288:vFQ1I4Op8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:NQutp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D5E4124957E445F8E1C60239A9F44809F7B371629B3A43CF0664479E2F33ADE5E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 940025de8de7de5775d6b46a9851e6f0a78e6c53a992e575393848ef4ce87f1e
MD5 44e274e916cbfa277c5eaa6711fa422b
SHA1 5d01ca1e855cb244464c4127653b4265643b48b5
SHA512 5eb792be1813aeb46477268360d349e5f0cd12fb04996c93d46f0754404f92f82933af95b92b81400e996cdf1475dacc4b222a7eb0e5223d6371654a2d56fb06
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UY:WQRQyi36YOcP8Lvw2gAf+PN3ocNzAz
TLSH
T12B667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1a89790563fc04f5c0e9929ed700e18048d895255d7dc25625118a19d57fbec3
MD5 77c2607ede7a947a7d9fee89bc19adff
SHA1 9fba459bd5209c16dc111f47abefbc979cb265e5
SHA512 aaf24f4ab2b010d8f50e46fc4035bd65cd326d29da1e7e8dc7dca7ec0899bf026e4735428f1105919500d0f70f1c1afe7bb2f65693674f1a25b4a8ed3f8721c2
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uu:WQRQyi36YOcP8Lvw2gAf+PN3WcNzAz
TLSH
T1C5667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 51df29e4367bdb45922abf91f88a98fa7265c8c7b9edf700d099069761236253
MD5 369bc15fe11c10f64b3bae0f3552bf06
SHA1 2114b6c53dd694c28cf5524f3fa5e773098321bc
SHA512 6114dc966620768ef0f6bdf2874d76bfb32181e6e742f7c9c54c81c2e11d65a55689c18a61b420f707ca60c28acc963dafb05c90571f2c7066047a6eea8997b0
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0vp8SXdo8ke5i5XC:368Qg55nhMeWu7PNU3/mWS1SZBnHTAsi
TLSH
T1EDB55A33B2F200A9C44DD1769F4A872196D27C71CFE1E3DB8515720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3fda34b0f42af9fa41f01045b7df53d8e66d63e9e2489fbf48cc2ad6e9db71ae
MD5 d3e6ea139f3ce5cb9b151b0c73e8fec3
SHA1 c7ba0cc43202af263415f416931b90d6d7d39a85
SHA512 71f178444308dcb82af850a3a8d848facb712a615135bcaf177762c6b320bf90f75bc8bc1876a68ff1e143da597fafe09a1ca8b782b2844a5db3daede72b4ce9
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99W:iy5112gYy5azzVv569nLKnhZHcNzAz
TLSH
T175168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 12d87436bd22ebcf76af9e67d9efbeeba2d76ed2a40c9d99b26fc33ad9578cd7
MD5 dcef3fda99c1ebf09e3a959032300e60
SHA1 ae4b2c00c514479fa1c5ecb938af7ce36a36a4bb
SHA512 c4ceceb9430d1556010f742517adb06c2b5e9ea1c8aae12fa6e03fbfbd859fcd2cd516c0edcf1fc924dffb76710a91e9a81df7db1f22c6865648ac4e62deec17
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glZWS1SZBnHTAsi:su6JmTxd2dZcNzAz
TLSH
T1D8D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a6552058f0ca50fbd83734738e0b2aa459d65ccf33a5d4854687225c29b5407b
MD5 2e6036dd1e87073c50c2b63f331b49ac
SHA1 ed3522f1be2cbeea8c0e8c4777ee109d23e06495
SHA512 05ca1d0cb6830b3a04b2226231dfb004182df4eacc2fd5f27c98fd3fbf5ab7d31f452cc6d10edc026725355af14de691f3179f040f5cb2169a9c4af616051fbb
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xzWS1SZBnHTAsi:tmifPbRicNzAz
TLSH
T110B5BE13F29901E8D05DC178875A9632EA62BC460B34B6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b601ed630f5e3c786872b998811808b901c4fb9f8dfcf4e42eb833db397f4a0e
MD5 c88b30716e7e72aff8e633a80f70e1e5
SHA1 8cfabb5a051256ff2e27238233944c18dfdd30c8
SHA512 92c3adddc359b9500ad77281b8a508d023f452b973074e737dce4fe299665b7ff5970e460334df1309dcf50f275b1b68c9589f1323a48f20cc70f4364f73593b
SSDEEP 49152:LSuZQIY0Be2K6RVtOnks6NMHq3WS1SZBnHTAsi:Z5dKoi613cNzAz
TLSH
T1B8C5BE03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 298b0003c25dda92695441c891f6990e93a9cdafe016acecbf634d8860e2ce0d
MD5 9f8566b08da0a3722b7ef36545e0e3bd
SHA1 9e776e0157cb9808925b367387b719adce2ecbe9
SHA512 17f8f175861a0c32608e9e97953fdd4db8c0224268d35c13babc22d8a3f8efacbed62a734c12e635ffa0b5cb36087d3cb6781eefd645f8f5233704af4001c008
SSDEEP 49152:jhtSn8EApI0figTgiDn0AP5wpWS1SZBnHTAsi:CX2iyphscNzAz
TLSH
T100A5BE13F2D900E8D05DD174C7568632EA62BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 f5660e6999ce3e598c98c32b09b6d8fd42d219a9f1b4329ecddbc7e9efa820b5
MD5 ca9c9b93d20019ea8ee7a9ebe13c8b5c
SHA1 028e03b2c722b408e97f64bd1278ccb4bf85180d
SHA512 5ad8c562dfade89b5a628c113109c6c6f93b0d8c20ddac37637b072cdf421183e7671dfc91e6e1ef938f8b00ca98bb9cfe8dceadf87099d05536920184ebe9ef
SSDEEP 12288:7dp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:7dp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T152D4230CCEA58E74F5840A317638480DFBFB6366CC6E070D17ACAA0E6B632DD5F52981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 c317b7d71964b06af7c931a3d70f1b41cc730474c46e0fc000375f03ca5a688c
MD5 2fa70fb877e211bec228a2c67346dce5
SHA1 939ef0f3f01b4cdb4c26db2bd86eb70d320be6fe
SHA512 bcd5443d9a77e9873add48a80365d33bc88b772de4a62a97a79c8235918cd9782fde281ef7617d4b5beeb0617cc0c6a0efe60b00a3abc4490f12825f1b79c512
SSDEEP 12288:Vrp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Vrp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T18FD4230DCE618E64E58406317638484DFBFB6363CD6E070E17ACAA0E67632ED5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 97d4763f41b79dee3037cff166b8607d9de139b5476e92b2818c00929be229bd
MD5 3d34fb274d3fad276837d4c8ff65bf85
SHA1 fb740eebc2361713f6e2220d9d87fe50266fb828
SHA512 4e5918580a60707bf1a47a7c0ad1fb23f941fdc6c3598cfd1738a53c285301856b86ccdbbfd3ca876b855c64ca0506548d5b1375f00279e792386cff23cdd412
SSDEEP 12288:DPp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:DPp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1FFD4230CCE658E64E5840A317638484DFBFB6363CD6E070E1B9CAA0E7B636DD5F52981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 abab94253ef0c3f212d349882143e12b7863249d8a66004a16bba06b45ddd144
MD5 99c9b5822cf80085a8499b850ddd5a9a
SHA1 2132610f4f92a6ca4816c4b27b6f2f79225b2a7c
SHA512 7bbe3c7d0816faec8e08ba4f272024483276ca04e1372bfb9b345f3d17542c6dc500558b6abbb6e1e8565562d5e611f9be66b2455868f0a2cf1eb2440a025ec7
SSDEEP 12288:klqp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:np8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T18CD42309CFA54EE4E8844631A974480DFBFBB3A2C93A070F4B545A4E1F7239C6E65F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 25d76ff8a319cc569c5d5750b1bbf923bc234f57796e3d8b92a092cc552122ba
MD5 5604b58063688b6a5ead592d8da03cd3
SHA1 f1d1446b4986000433454b78fca44f77b3de92dd
SHA512 0f6a2b03c39e03b04fc6dec3443248deaa2fcbbd3954a233b45c7f06f10f7dc27bd7cdcd0572adf18942d75a6e26fc922e782c026f60b623bec4a801e24e545a
SSDEEP 12288:SWlp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:SWlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T128D4230CCEA18E64E5C406317638484DFBFB6367CC6E070D1B9CAA0E6B636DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 7173692f35f3319885535a131570cf0edcc474ee510b82dafa345dbaf106f7c6
MD5 7dc10b3d12df89d382082ef3bd5291be
SHA1 9e8ab326fbffa2a366d181472cb34c4cf169808d
SHA512 cc0ec3c400131a178ddf50b20c4304810a2ba42a28701e8bd3b092df54be47d8db4d1f34aefff15f61c23629084ee6b99b7a2b919fa6467669f033629e6ece2a
SSDEEP 12288:pWlp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:pWlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T10BD4230CCEA18E64E58406317638484DFBFB6363CC6E070D1B9CAA0E77636DD5F56992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 ddbc27f9916fa8c017bf415b185840455aec9da4d930c136fb3911297f5118b3
MD5 63cdce4e352140316c18c1400c7038e7
SHA1 7d5ac05633c452167af4ec9ba878d9f9ce6f3ea0
SHA512 10de4ebcda7744cb6ad1827a59de42db47b6aed54ad4e4fc44cfe21343ca56cc0b044f31c5cb0d1792a17d2b12ddd9b6f00d9a4c2b3f43569026748f0aa18e35
SSDEEP 12288:KNp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:KNp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T172D4230CCE618E74E58406317638484CFBFB6363CC6E070E1B9CAA4E77632ED5E66991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 51f4b00deeabe138a8a2b408eb0b1f52f9437b481520f8bdf9149e95e729b7fc
MD5 3ba6782578ef9e8a848f71e2a551556b
SHA1 b787031fd39fa18703cf30026a9bde84a5c8d078
SHA512 7aadb7bab60254ad02800c0c09c0a1b8d43e8b5f292100b6f456c297a0caea4a246cc764251ad7bee1a7b2f703f69a93e34fe20ca1f7e19ead87949782b9f5df
SSDEEP 24576:HZMtzFVS1fp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HZMtzfiWS1SZBnHTAsi
TLSH
T12F15F195B7900CF4EC97423EC964880AE6B27C564A74C71F03A8366B5F333A51D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 8efe20a6de85667e6488e7106b82885485868af5e4b720e459c45081939110de
MD5 01490fd02ddee2942de405a83b3920f5
SHA1 01fa9730336d27a659c263d3ebebb7c3d38c9b0b
SHA512 fd06c0228390b3889dff437e02ee5af8e36b89c7866fe52fb70e354c27ec4143bd0c011f2068136b65dc4444bd40db6816eb21dd554fdd11aa139094aeb9ae70
SSDEEP 12288:DmEp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Dtp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T13AD4234CCE618E64E5840A317638484CFBFB6367CC6F070E1B9CAA0E6B632DD5E56991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 c7a15c4c80c216b6571588452e780f8666b30f1f5c58d40497ed1e5569fe1893
MD5 95813524d79598f2f85f7ab2e59c4aa4
SHA1 b0fa1c958e3d384151e182e8b2ff6660441942b0
SHA512 5a65dd0b2b7e6cac39a45ded3504a5a6a55ef9a8c99ee7c058f0a88296e116e1f13424e96a3559d9c70cbae6ccdec0cd2787030653eb045904b3280277c0496d
SSDEEP 12288:Jkp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Jkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T122D4230DCE658E64E5840A3176384C4DFBFBA366CC6E070E17ACAA0E37632DD5F56981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 dc59030278debff1b7c574f380c12bb6a86af99d662aebd8ab88ee4b016250f8
MD5 ab0705425212055a1d43c71f43c1b096
SHA1 4814c79bc5b955d70f0a840bfdb8423bfafe7fec
SHA512 aab9bf01d1e5c2c0f001641a70feb67b6216a76c0de388c5c7b57ce064cf26c61ee165e71ec9a65fd079d5104c6908c433c0933d2d2a9335116553d50787061a
SSDEEP 12288:qKP/VL97p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:7/D7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1FBF4120BA7A125F8E1564234D9650D05F7B7B4328B358B1F17A4477F2F233A89E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 b77ec479fa88950a6fec3a13140c7aa5055a8f1399ecbcf7b5b522340f34f91f
MD5 953dba9a17cfe74f43db6d6a8decdb66
SHA1 4f6e7225bf61ea5096ca8b556c6e79cae0de8291
SHA512 92af12d5bed2cf19ee480d5ea80056b5f5d218bf95d22256f666c066c0fd46cc4d367cc2285dbc0996a041df2fc83220a64f367635b56a8ed31739f0c733174d
SSDEEP 12288:fkp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:fkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T11BD4230DCE658E64E5840A317638084DFBFB5363CC6E070E1B9CAA0E7B636DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 349dfb9e573011f7a4236a44e312d2e647c5b9a930a1f4fa3e778c93937d8458
MD5 6a42c5892f2d05d1e105b250a40e6382
SHA1 d414a2e8d6367d91189dafa7fd2231bfe58b5cc2
SHA512 6e763d08ce1a872121157096c4c39a0ba528611f271d07dcca7defc828c27243f10af8cf24d921ce515be1fb269c1893e2d0efca53ed2b5fb3f1afd61c8c95e1
SSDEEP 12288:Llp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Llp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T102D4230DCE618E64E584063176384C4DFBFB6362CC6E070E1B9CAA4E3B632DD5F62991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 a0741a9dbdb437592a468d986a774f329bd2a14ceafff205092242a303592424
MD5 8deb793869e7968d39c5e31f8284f092
SHA1 faa9e2e2bf92551c6c88c4d42ee730b0540b88b5
SHA512 dcfe2e86fba5d8ce44ebe696a400cd54bd6b0900a735000005158f18a8e7be990faa9490d3982fcccd6629d9ceff355f7da43ce827028bec927258e793026c64
SSDEEP 12288:vKP/VL9Gp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:K/DGp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1F4F4120BA7A115F8E1564234D9750D09F7B7B4328B358B1F17A4477B2F233A89E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 811a739d878f43e32a88830e33cb11626b2c029cb076386a1947d6ea1e4e6f03
MD5 1068b4a9933be28cb81e1dd03c7c4231
SHA1 1044289a345441cf7dfbe75b9e411920acbedd07
SHA512 0ed065b1057173d882890ced3f4c91a9d39fbcb51894712d33ba50a0eb8b612fa8feeaa0d099168494f7805d81438d8989032cced2411df94bf46d47a4fc8560
SSDEEP 24576:KT2aLl3z0zSRp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:KTVLljNWS1SZBnHTAsi
TLSH
T1A3150198B3504CF8EC97413EC925480AE6F27C5A4A74C71F07A8365B5F333A51D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 2cc732edf6b1410aab4f785554cc47f67e9773161757a74886b295af507100a8
MD5 6b7d7895c93ac942009462041124396b
SHA1 e35044638a2e3e56ed21e4f839321cd6fbb5015c
SHA512 a0e9d89352b38bd9f341854812f1d2bc2c4faaa1e18c543688c3ec7795aa0e3eaf44cfd75cec7453f70bb007a24a42d0be4ff3c102918571b05573980ecda0fd
SSDEEP 24576:F3UdcCHKy7RcFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:lUdcCHKylcWS1SZBnHTAsi
TLSH
T18135CF90F7E404E8F0B78A3599754501DAB67C5A5B31DE8F03A8661A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 cedcc31b2bbc478271862245e17b7a5afdad0c6ce6f46139e7472a10fe9ead46
MD5 5ee57ba161eba9627d6ba1f481a9b28b
SHA1 9b0f028a60d4fce2b79ea1dab0b59872335b4e6b
SHA512 a5413fdcad346a63e79c3efed6bc62ba17c2b6fb7b730979f82bb31e4baf072befea29179908c9b16320adb2a2fbc27d7bd113d460d234d831eb24dc88a657cf
SSDEEP 12288:1xp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:1xp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T125D4230DCE658E64E5840A3176384C4DFBFB5367CC6E070E1B9CAA0E6B632DD5F62981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 9a6996a3ecd168b741fdbe6bddbb21c8df42f91f3144c48f1f70966fa955e07f
MD5 7d11b274678ab9abe870ee311c7a9cc7
SHA1 acfe4828dc20d1d53d0ca222e39019a42ef2d198
SHA512 e93d9778499f9f252fd1b60b9e9bec6f9f4c3a1085c185b9c143dc4216d6eb8d90452dd864d576e4c53356f36a707278a0df1a082356976722ce3e1cf0eb7df1
SSDEEP 12288:Z3p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Z3p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B8D4230CCE618E74E584063176784C0DFBFB6366CC6E070E1B9CAA0E6B632DD5F62991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 8446ff42c3e2195bf0d269b569db76900ba9b6411e45ab778b73d4e9a4fbf2a0
MD5 324c5be51659f704db307fbc73c7bb07
SHA1 26c822c1d40123697f2676817178a064bcb9c301
SHA512 c14879ec77be77ae66f25c988575158047c39335aa5ce25197ad77c9a05f95ce394706e67fa755ff9ea9626840020cfa26b734dec9f84e76cdea659b6526dd6b
SSDEEP 12288:+np8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+np8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T180D4230CCE658E64E584063176384C4DFBFB6366CC6F070E1B9CAA0E6B632DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 1eb0cffc9a5f956096dd493ae44ac341ad838390629b7d2a006cd4cb2d0027a5
MD5 c41292dc9cf58d13f026f0116c1b448d
SHA1 2a263cf9e6c4e7504a69a0bba3366d18918723b8
SHA512 bacb01c0d5a1ed3d3f3765220782f70b7d2516632585b95bf31c7c862833f66f049b929aea9194b8a4ecc4018733c8fd613002f3ad31a5dd63368cecded73c94
SSDEEP 12288:1Map8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:1Map8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T19AD4230DCD618E64E5840A3176384C4DFBFB6366CC6E070E1B9CAA0E3B632DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c7cbb931b07f9c7a375053738362ceddfad5b29faacc906c91ca148044f21ba4
MD5 c44308b5d1d7e6fe93efe6845d752588
SHA1 1be0109550b99a274eeab8259279436af0c8d1de
SHA512 2cc4d08aa00e3c7a5ed8b93db4679d7086975cde929b97d7ac9761799c4e348b81e16813b248a141f8af46fbb148fcb10ce7dcc949066293054a995677eba795
SSDEEP 12288:07sfQp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zQp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T148F40109C2A846E8D09E1235DB644944F7737D2186F6938F17D0F93E1F762989EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 0a03d48afdc8188a9dc16a986ef52e9b858fd277ad4989cb2a00935a2331ec01
MD5 f9f0da49862fcaf7cac7db68b227170b
SHA1 f5c05b97ccaae2c03b3a2f0046b7150b0e81ebf8
SHA512 12e2656e8d4cbad33cda1c76a37f7e88e68995cde74eec6c700a48da8c41ccbb18b39722e6c4bcd1828ad2cc6484feaff617cc02ea5d7c7df0db3753fe529780
SSDEEP 24:KQMyis6zBLtPWeElpKwG6RfafPqonhA/I9ixM:dM7/zBNtEl5GcWnhAAG
TLSH
T1D972F6E08B9D9F65E93F403C9B5227EF5375C9016490EBF71258632A2C4D7844CFE629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 46a6b8f668300bbb58502ea40c1522ebe6c65d5dccee204c65d69e64455e9bb5
MD5 c50c7fba13473765b3d67c62279379ff
SHA1 466e428bf2539b02cf357febdef9b6cf9cd9950e
SHA512 ea3cad9e78848f8286376ef6c60c47ab6e68bc5c8e858534063e9dc46fca75b4b1cfbf374c573a51c628a40fa1c3bd879a098b07db1d3cdb9a0cd5008b44ad7d
SSDEEP 12288:jl7Rup8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:J4p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T17DD42319CF658E64F4C80A30353C480CBBBFB371CF29474F6658664E6A726DD9EB1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2457ad85d89b444877de1fbb84d46e5955d9f2c083188c232d267a00c59683ee
MD5 6d8dd5452dbcc49197fa6b0aec02df00
SHA1 b7a038bdf20464681e5c485925794291098f9622
SHA512 0490688fc89178b041b672e87b8ea1ba5953e8d75cbf0553b82ab2925e2f7407f548fe6b5744fd6c01b01de7928eec362008a5d3b4850c23b4ac14778d77a8ec
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY4Fp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGFlWS1SZBnHTAsi
TLSH
T18965AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 c9228668c3cc3823f84e7de82f95fecf883d54767fc47b32049d101fec0c7729
MD5 0244b3bdb6ad17c12d1687af02545e67
SHA1 48920f66c6d1a4328272a7c42d286349f8092bbc
SHA512 0f1ae07b0c788d7841eee601f907e53ebd0a97830d7c49df822a17c8c27048b2684d7fe998cbbe6d50e78c3f5889abe83cbe65e918ab473ceba21ec8c01d6950
SSDEEP 12288:7ZGkp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1F9E4231C8AF149A4D46847356538480EBAF373708B2917DF0AE4E63E9F626EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 61a7e374d017c1dbd3fe96306c83d03aa39bab852c977df75cb45f4da7f7bb72
MD5 9a6a6784e45d5683bd8bb11e77d3f88e
SHA1 e7d476e04f20e1ce4258b18c03c10525f0c1fafd
SHA512 b764498ddb0cd6b0454e3733e56d09d3a9ef0ef45beabe7fdb75c26b9dfd4f8447b4b167bd91373df17a39573f0c674d01371b74877a424133ab290f734be23b
SSDEEP 12288:SSMp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:SSMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T188D4234CCE648E64E5C40A3135384C0CBBFB9322CF6E07CF1698A64E66676ED5F75942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 dbc29266727d0f747e10c3b21b65bd793548c68d4a4b7c9a6e9fd92feb5b1d9d
MD5 59d56e50e775a732ac661a52c3473b47
SHA1 ed10ad7cbf90e759f581ea977548ed1f47a32715
SHA512 83a578df9d81dbd90fe5e05e0810d7d22d79588b0813ca4341275265133e3525b7b2b4700fb30883e8f398f7325501102f869cf8ec2e795c6476996059a76fd5
SSDEEP 24576:dAZ8u8FpJqH14zria7/mMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/TWS1SZBnHTAsi
TLSH
T12735F165A7E001F0D47BD1388A564667F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 f31e7148fd7186c49e5bb09364f996638b5bcc8b5a66a5bd7b4720b2295ea102
MD5 48637f7345764317c2ed874549ce4a35
SHA1 3d55cf90e1fbe64ca4e521710b8791ea14a721b3
SHA512 8914d6e71831e8e9952b1c2a760da9d5d6405f5f4eece0c7181d67b19a7d371cdb36c2ef7ef31d85b043fe91ae021129b0eaddb035dbbd12384aff048753a5be
SSDEEP 24576:iPUr+NQzp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQzWS1SZBnHTAsi
TLSH
T13505F11F66A80CE4E676A13D9955860DF772B462471293CF02E0817E5F63EECBD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 bd53f3d9bba10a225a616c916c174e4bc884b3fcbf2b6a5db5587c86e77b4568
MD5 8ac1716cc82a8a12701a8be03526fea2
SHA1 8ea94aa3fe962457a15e94c2a58acc445c062974
SHA512 6f2f14a59afd68a7784b00d474b706267c475e45dac037c0f77c2ce1e9b73538ca873679dea1812830934c0d4d2fd787ee268d5bc6254d9db2f646a64f56dc2d
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjAWS1SZBnHTAsi:OG05lO43bNcNzAz
TLSH
T161D5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0190e327db0773eb396746765bb080268acc9527283bda1016ed32f41bccf2fa
MD5 e0c5848765ea82796b507055f8d745bf
SHA1 580611e9a09bd5d0122a03c9d362e0632204ddbe
SHA512 01d9c8c33aa217ba3c3b0ae541f14dd1bb0078fd9748611b606f2fdd8d32a8e2dacee6021b53f57283666ce572ca9e9a98b3f4590a359bc688db885e29da45fe
SSDEEP 24576:FMa5POZ3dpbWVM50JicR2hG0lasx2+47eidn/Ymp8SXdo8ke5i5Xh6wnBLTHTAck:Wa5POZ3wJt2pasx2+mZWS1SZBnHTAsi
TLSH
T17D65AF5EA6F801D5D5B9D17DC583461AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 00db645c64451f1271377bc2fcd7d65c6b68f4d11a3cee20aee55dd2e58cd685
MD5 699313f9fec7dc30ac30ac0858c3c252
SHA1 ef40ccde1d6e56b3d39f7dc3d8f3372b045b47ef
SHA512 91067a02760889ba15ec5fb7ab2228fa2fce90a8f975db4991881cae28fa2acfc96d8122e6205f28ea770247224c951c8b6ea2d90f25e2050567b0b756e57565
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7Fkbp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHFsWS1SZBnHTAsi
TLSH
T14C858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 e0c8cbee76e4dab97eaacd5ae134cfab87d27006a3b44b829cb475ae7252b300
MD5 d840e99a3307a0e13a56bf3423ba4a81
SHA1 daa9959744de3d34db80d8923509d110835e8c5a
SHA512 de52fd238333993fa05c92fd28795a265ebe852faaa34fb305efbf2e37d2560d41151291196e1c86ab22f7c11b01db31f2498e28349d01b167cc5537dc95827c
SSDEEP 24576:MJnJPbzB4Slp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6SlWS1SZBnHTAsi
TLSH
T1F815E03DC2A800E8E4B7C27481191A59FF71347D2F266ACB19B4D5353F12EE4AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 212367c92605f3c0002cabdcd6c7634d5588f106abdfc1364cbf647c8b5f2162
MD5 2f3560384cfb5671ea15167c3526f071
SHA1 5b7b013198d3149fa54430200b6df00f445d5093
SHA512 1c9b4585dbcd23023b5eeec8e5aab3d312d70984e7d262f68a96d42be584d1ca9d1f4ed0f84f2f12553434ec739962c0093754e0d5c79337d1899b1badbcd74d
SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDk6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:8CLHGeeV5ijCmlDWDk6WS1SZBnHTAsi
TLSH
T163A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 e86f8c26885bd819e9cf2198d8242b1fdc06e327a54465e4ddfa60c80f8223e8
MD5 61f8fd464fee4e98c2926764054961ed
SHA1 4c488820017b3c0f2bece5a566159d5f926197f9
SHA512 39004ab51af06de2ece2025d4b6e2be5922dce57cdc6c54cabb9d859246d3ca0633d59cf04ea8329e886db15a800be82db7ace6780e4068d110e3b2408161c06
SSDEEP 12288:q1Hck6j5ZI72p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:W6DI6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T190F4015C637A01F5D0AB903A96920405F6B2B171C7261ACF0BD8C5BE5FA3EDCB939E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 664a7281d51d2b69abe13f4e241c1c9e46d46f309278cc6d2af67edbff6d04d2
MD5 dbf58e668440079df26f14dc77ddaa5c
SHA1 4e27cbe044c8b0af754a1e5a76c943c60f241084
SHA512 e32503f837fc4669f0fb02c11da3fe98a652b19f307c9a16a4150d6b98117aee78ba9680eaed7443eaf412c4bc8858c5edbf92c4e1b35d4efbe2a4036090c96b
SSDEEP 12288:dG6kyvp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:ktyvp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1E8F41208879449A4F9A90634AA754448BF76B9218F2643CF16D0E72F2F327DCAE71F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 cf4af8200f266f3f3bcb60143dd6aca605856cc0240939cf6bfb353f2fae82ea
MD5 9db9c588cd7876333ee97b1ecb52d9e6
SHA1 92c622c2644e1085450025f5759ae7f4ac3ed1f2
SHA512 e6d9b240bc09915d81373db01ec004a0399ce1283eac6986ed732e6ab522127e224de810d143a768bac6191fce3bfa15d2f45842e2a49ac01ed0b031214ec2f2
SSDEEP 12288:LIwp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Uwp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T159D4231CCA658E64E8840A3135384C0DB7BB73718F2A07CF1AE8AA6E5B672DD5F71D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 3c861537857b2629e41482e32c58f467ccb97e85440d6bc23a0fa631fba3e213
MD5 e0738ddac155e10820ce62e671438452
SHA1 3fa06bb384fc4a25c2051784cfaf5340d9b2831c
SHA512 ccb5fcbef27c86aa59230cd06ddab9ce63f0c54bb727d21fcf47aed1256367d71112d4652768195a4f7e046d85520378c3d173762a617006dfff22a898f1d85f
SSDEEP 24576:tMgdLoTfaidZhp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:egyTrZhWS1SZBnHTAsi
TLSH
T1AE558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 7e92e9608353294c01ea94b7ae5bc99495fa2f7f664c938d62d5092897877ba8
MD5 24b50b9e77d3f065265c95f81420a467
SHA1 a3fe94e6829ba0a0ede5078460b006643e8d233b
SHA512 daeaf4761f17a981f287106e6b5a15edc29f1de0f661ed1be6ae9fc0ffa3d63f045818333f37f5346bf0bf4aaf8344cb8411ce5b31b9d72fb84d69c9d2314ea2
SSDEEP 24576:KrcmROp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:scmROWS1SZBnHTAsi
TLSH
T12E05F14EB6AE00A5E1B7823C89444509F7B3B031572267CF02A0C77E5E67AED7E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 03e9c46474acdf75232cba1ba7a191d2a19a74ef96795d51de00bf40ccee15d3
MD5 08ac0bf0e7cb849a871c951a35eea7b9
SHA1 d25177db66173b3fda4705cfa26fbe7106ef0c6d
SHA512 a0074e619625b89cbd5886af16a640d7d2ba4714cbfd4502859852757b32bbf20b7e5e0a1514e33c93553d831ac03dbd13e281a1d17d8775063752e8ec9c4d08
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3SWS1SZBnHTAsi:j3Upow8sBLcNzAz
TLSH
T139A57C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-60-0x0000026D3BD40000-0x0000026D3BDA6000-memory.dmp

Download

memory/556-59-0x0000026D3BB20000-0x0000026D3BC13000-memory.dmp

Download

memory/556-61-0x0000026D3BD40000-0x0000026D3BDA6000-memory.dmp

Download

memory/1272-587-0x00007FF7D6BD0000-0x00007FF7D6E73000-memory.dmp

Download

memory/1272-518-0x00007FF7D6BD0000-0x00007FF7D6E73000-memory.dmp

Download

memory/1272-519-0x000001C399D30000-0x000001C399D96000-memory.dmp

Download

memory/1272-520-0x000001C399D30000-0x000001C399D96000-memory.dmp

Download

memory/1704-112-0x00000202029D0000-0x00000202029F0000-memory.dmp

Download

memory/1704-101-0x00000202001E0000-0x00000202002E0000-memory.dmp

Download

memory/1704-113-0x0000020202E30000-0x0000020202F30000-memory.dmp

Download

memory/1704-123-0x0000020202DB0000-0x0000020202DD0000-memory.dmp

Download

memory/1704-146-0x0000020214230000-0x0000020214250000-memory.dmp

Download

memory/1704-102-0x00000202001E0000-0x00000202002E0000-memory.dmp

Download

memory/1704-100-0x00000202001E0000-0x00000202002E0000-memory.dmp

Download

memory/1976-488-0x00007FF788D70000-0x00007FF788E1D000-memory.dmp

Download

memory/1976-566-0x00007FF788D70000-0x00007FF788E1D000-memory.dmp

Download

memory/1976-489-0x0000023F11450000-0x0000023F114B6000-memory.dmp

Download

memory/1976-490-0x0000023F11450000-0x0000023F114B6000-memory.dmp

Download

memory/2376-38-0x000001DA43100000-0x000001DA431F3000-memory.dmp

Download

memory/2376-40-0x000001DA43320000-0x000001DA43386000-memory.dmp

Download

memory/2376-39-0x000001DA43320000-0x000001DA43386000-memory.dmp

Download

memory/2376-41-0x000001DA43320000-0x000001DA43386000-memory.dmp

Download

memory/2636-26-0x0000000000680000-0x00000000007AC000-memory.dmp

Download

memory/2636-0-0x0000000000680000-0x00000000007AC000-memory.dmp

Download

memory/2636-1-0x0000000002540000-0x00000000025A9000-memory.dmp

Download

memory/2636-7-0x0000000002540000-0x00000000025A9000-memory.dmp

Download

memory/2736-528-0x000001305FDC0000-0x000001305FE26000-memory.dmp

Download

memory/2736-529-0x000001305FDC0000-0x000001305FE26000-memory.dmp

Download

memory/2736-527-0x00007FF716220000-0x00007FF7163B4000-memory.dmp

Download

memory/2736-631-0x00007FF716220000-0x00007FF7163B4000-memory.dmp

Download

memory/3208-579-0x000001F394A20000-0x000001F394A86000-memory.dmp

Download

memory/3208-578-0x000001F394A20000-0x000001F394A86000-memory.dmp

Download

memory/3208-577-0x00007FF6A53A0000-0x00007FF6A54CE000-memory.dmp

Download

memory/3284-448-0x0000020311D90000-0x0000020311DF6000-memory.dmp

Download

memory/3284-526-0x00007FF72CB00000-0x00007FF72CC19000-memory.dmp

Download

memory/3284-447-0x00007FF72CB00000-0x00007FF72CC19000-memory.dmp

Download

memory/3284-449-0x0000020311D90000-0x0000020311DF6000-memory.dmp

Download

memory/3900-642-0x000002B6ECF80000-0x000002B6ECFE6000-memory.dmp

Download

memory/3900-644-0x00007FF76BF20000-0x00007FF76C336000-memory.dmp

Download

memory/3900-497-0x000002B6ECF80000-0x000002B6ECFE6000-memory.dmp

Download

memory/3900-498-0x000002B6ECF80000-0x000002B6ECFE6000-memory.dmp

Download

memory/3900-502-0x00007FF76BF20000-0x00007FF76C336000-memory.dmp

Download

memory/3900-576-0x00007FF76BF20000-0x00007FF76C336000-memory.dmp

Download

memory/4112-56-0x00007FF6627E0000-0x00007FF662948000-memory.dmp

Download

memory/4112-54-0x0000027F8CC10000-0x0000027F8CC76000-memory.dmp

Download

memory/4112-49-0x0000027F8CC10000-0x0000027F8CC76000-memory.dmp

Download

memory/4112-48-0x0000027F8CC10000-0x0000027F8CC76000-memory.dmp

Download

memory/4112-47-0x00007FF6627E0000-0x00007FF662948000-memory.dmp

Download

memory/4332-547-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4332-468-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4332-474-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/4332-469-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/4536-509-0x0000015476690000-0x00000154766F6000-memory.dmp

Download

memory/4536-584-0x00007FF6EB7A0000-0x00007FF6EB853000-memory.dmp

Download

memory/4536-507-0x00007FF6EB7A0000-0x00007FF6EB853000-memory.dmp

Download

memory/4536-508-0x0000015476690000-0x00000154766F6000-memory.dmp

Download

memory/4616-481-0x00007FF6B19B0000-0x00007FF6B20F3000-memory.dmp

Download

memory/4616-482-0x00000196CF950000-0x00000196CF9B6000-memory.dmp

Download

memory/4616-480-0x00000196CF950000-0x00000196CF9B6000-memory.dmp

Download

memory/4616-557-0x00007FF6B19B0000-0x00007FF6B20F3000-memory.dmp

Download

memory/4780-65-0x00007FF6914D0000-0x00007FF6915F2000-memory.dmp

Download

memory/4780-18-0x000002CE557C0000-0x000002CE55826000-memory.dmp

Download

memory/4780-17-0x000002CE557C0000-0x000002CE55826000-memory.dmp

Download

memory/4780-16-0x000002CE557C0000-0x000002CE55826000-memory.dmp

Download

memory/4780-15-0x00007FF6914D0000-0x00007FF6915F2000-memory.dmp

Download

memory/5072-559-0x00007FF736000000-0x00007FF7364D0000-memory.dmp

Download

memory/5072-560-0x000001EA19F20000-0x000001EA19F86000-memory.dmp

Download

memory/5072-558-0x000001EA19F20000-0x000001EA19F86000-memory.dmp

Download

memory/5092-548-0x00007FF6AACC0000-0x00007FF6AAF4A000-memory.dmp

Download

memory/5092-549-0x0000029BD3110000-0x0000029BD3176000-memory.dmp

Download

memory/5092-550-0x0000029BD3110000-0x0000029BD3176000-memory.dmp

Download

memory/5092-646-0x00007FF6AACC0000-0x00007FF6AAF4A000-memory.dmp

Download

memory/5140-430-0x00007FF7D39C0000-0x00007FF7D3A88000-memory.dmp

Download

memory/5140-432-0x0000020ADB310000-0x0000020ADB376000-memory.dmp

Download

memory/5140-506-0x00007FF7D39C0000-0x00007FF7D3A88000-memory.dmp

Download

memory/5140-431-0x0000020ADB310000-0x0000020ADB376000-memory.dmp

Download

memory/5180-569-0x0000019AA8210000-0x0000019AA8276000-memory.dmp

Download

memory/5180-568-0x0000019AA8210000-0x0000019AA8276000-memory.dmp

Download

memory/5180-567-0x00007FF62B740000-0x00007FF62BC46000-memory.dmp

Download

memory/5320-544-0x00007FF6A1390000-0x00007FF6A16B0000-memory.dmp

Download

memory/5320-542-0x0000024BCFA50000-0x0000024BCFAB6000-memory.dmp

Download

memory/5320-538-0x0000024BCFA50000-0x0000024BCFAB6000-memory.dmp

Download

memory/5320-537-0x0000024BCFA50000-0x0000024BCFAB6000-memory.dmp

Download

memory/5320-536-0x00007FF6A1390000-0x00007FF6A16B0000-memory.dmp

Download

memory/5744-588-0x00007FF7986A0000-0x00007FF7989DE000-memory.dmp

Download

memory/5744-590-0x000001AD1CC60000-0x000001AD1CCC6000-memory.dmp

Download

memory/5744-589-0x000001AD1CC60000-0x000001AD1CCC6000-memory.dmp

Download

memory/5796-261-0x000000000F360000-0x000000000F3E0000-memory.dmp

Download

memory/5796-371-0x000000000F360000-0x000000000F3E0000-memory.dmp

Download

memory/5804-462-0x000002CCACEF0000-0x000002CCACF56000-memory.dmp

Download

memory/5804-459-0x00007FF67CE90000-0x00007FF67CFD9000-memory.dmp

Download

memory/5804-461-0x000002CCACEF0000-0x000002CCACF56000-memory.dmp

Download

memory/5804-535-0x00007FF67CE90000-0x00007FF67CFD9000-memory.dmp

Download

memory/5856-31-0x000001238C160000-0x000001238C1C6000-memory.dmp

Download

memory/5856-32-0x000001238C160000-0x000001238C1C6000-memory.dmp

Download

memory/5856-29-0x000001238C010000-0x000001238C103000-memory.dmp

Download

memory/5856-30-0x000001238C160000-0x000001238C1C6000-memory.dmp

Download

memory/6064-439-0x00007FF7D39C0000-0x00007FF7D3A88000-memory.dmp

Download

memory/6064-517-0x00007FF7D39C0000-0x00007FF7D3A88000-memory.dmp

Download

memory/6064-441-0x000002908FA60000-0x000002908FAC6000-memory.dmp

Download

memory/6064-440-0x000002908FA60000-0x000002908FAC6000-memory.dmp

Download