520de970bc0f0a040456bb6f2854ca0a4f8f62749220f635c342c87154e21a12

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Size 2.2MB
Sample260822-k3afvsxta1
SHA256 520de970bc0f0a040456bb6f2854ca0a4f8f62749220f635c342c87154e21a12
MD5 a15e985072d4e1e621328f04a8a42c2a
SHA1 c87e10d905110b2085b9125c061fd0c71d3f2bda
SHA512 399da371f24a6d971a93fdd9aadc87a645c0c44aed62b7f0c23e0765704f17d120006a15fff73b10adde5db0bbccb32d76eb9b15b4a0632bc1928c6f6c4ae956
SSDEEP 49152:HtCejjt1nAV97yKtFnFK2dstEPObWjBqLrH9pLDmg27RnWGj:Ht7j2AbJT9dD527BWG
TLSH
T13CB5BE42A7D340B2FD866633112EA7139B39AB094313E5DF96A03D7069712F35A7E2D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
976	alg.exe
1772	DiagnosticsHub.StandardCollector.Service.exe
2272	fxssvc.exe
1852	elevation_service.exe
1560	elevation_service.exe
5000	maintenanceservice.exe
3600	msdtc.exe
2096	OSE.EXE
2628	PerceptionSimulationService.exe
4592	perfhost.exe
1320	locator.exe
2204	SensorDataService.exe
4272	snmptrap.exe
1716	spectrum.exe
4556	ssh-agent.exe
1104	TieringEngineService.exe
3432	AgentService.exe
4964	vds.exe
3420	vssvc.exe
5012	wbengine.exe
3928	WmiApSrv.exe
3980	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\V:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\K:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Q:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\A:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\E:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\G:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\L:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\M:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\T:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\U:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\X:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\B:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\H:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\I:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\O:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\S:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\W:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Y:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\Z:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\J:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\N:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened (read-only)	\??\P:	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\730359d168b29bb.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_95875\java.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b6833a51532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070422ca51532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a8008a51532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f6a14a51532dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014dc6aaf1532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a2f19a51532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b6833a51532dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeAuditPrivilege	2272	fxssvc.exe
Token: SeRestorePrivilege	1104	TieringEngineService.exe
Token: SeManageVolumePrivilege	1104	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3432	AgentService.exe
Token: SeBackupPrivilege	3420	vssvc.exe
Token: SeRestorePrivilege	3420	vssvc.exe
Token: SeAuditPrivilege	3420	vssvc.exe
Token: SeBackupPrivilege	5012	wbengine.exe
Token: SeRestorePrivilege	5012	wbengine.exe
Token: SeSecurityPrivilege	5012	wbengine.exe
Token: 33	3980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3980	SearchIndexer.exe
Token: SeDebugPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
Token: SeDebugPrivilege	976	alg.exe
Token: SeDebugPrivilege	976	alg.exe
Token: SeDebugPrivilege	976	alg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
820	2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1768	3980	SearchIndexer.exe	112
PID 3980 wrote to memory of 4720	3980	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_a15e985072d4e1e621328f04a8a42c2a_amadey_elex_pay2key_smoke-loader_stop.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:820

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1388

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1560

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5000

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3600

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2628

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1320

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2204

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4272

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1768
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 026837d3d1cc8f831ba3323ab719ea5ed414c8d6dc6d4029b0e524ee489e8480
MD5 b1147e1c78184fb9e790b23b4e164845
SHA1 1ee29865af83689ebf6a13328b2b0b5f6cff881a
SHA512 a25ad66c6955e32c250d6473646c1c1ad4859e5cca62af9da64204236333746a711006cd48cbd9cde5ad19d566be727287557d3c5f016787509e7973182ac083
SSDEEP 49152:Ib+632BuPkFKRrdE6ohvstBhuXjfS4LWxnpDmg27RnWGj:i3q6sjBeD527BWG
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 b0b11c44ff76291618a7e7d32aa3fadfae09f40dcacaacc4091afd66318c2353
MD5 6048617338b3bdfa1cdf61e52ed815a4
SHA1 a83cf3bb8aafa7a1b4b48f3e8d7304d67eced0ac
SHA512 3b00414169848d727750ee56c4cda5cd2ee289ca90c38f1125d4f2809a36e5dfda465372ce2f2fbf88d2c44e811343036a1714086f1ec637d9d38f14dbdd17b1
SSDEEP 24576:WXYfDtczAesqjnhMgeiCl7G0nehbGZpbD:Vtc3Dmg27RnWGj
TLSH
T17385F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d4602e78acdec06392c3a10a98f407c78c6a64425d4946cbb5c6bcd37db682ad
MD5 d63e57faa9e4b46aa80e62a7462a885c
SHA1 bc647c9bfd3d737b4be8ac16b8aebf29154927d7
SHA512 af47bbed8e35ac791ad5e4bc55601acd9731e13bc9553a9bb0a95e88a91d4e6603d21899548bf4fec95e3035942012e6c8dd87e798605d86afac18d671d5d9f1
SSDEEP 24576:80Le5ji0hmx7rMNsqjnhMgeiCl7G0nehbGZpbD:8Pji0A5EDmg27RnWGj
TLSH
T13C959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fc9cc9d7cc0da38ecadbdae07cdf0caecac4e45c075357f6a9c0e49172a36cee
MD5 1ea80e479d3f7de9dfaa9a2a7a8ce558
SHA1 a45fde8e21b66a3977835a90e2533e4051049c8a
SHA512 9a380a717c253cd8dc3c7ec6c4849aa730fb95869c8eb38afcad1c61bef440fa2e52d01f9590c723429363e820514cc93dfc520bc9ead77e98fda93859fbd7eb
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWn6q8wyuDsqjnhMgeiCl7G0nehbGZpbD:F/ezSC6vUzPveHjyoDmg27RnWGj
TLSH
T1C7755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 65584baa93407a4a399eff9cdf82b4f368233bfe59f5eb089565b284ff55ab91
MD5 c83a12998d8486a2034c326738550197
SHA1 84c638a8f6044c8b0d2f183b58e4952f0db18834
SHA512 55d2e43648b1334b7fd42ce8125b2810b6b3541152bb14bfed814c80167d4d70280f7d8800177a2c0e68be684e9911eed8b75be001a6f36e6c4911ba6b95c8c8
SSDEEP 24576:tVbqPb88hv/l+YasqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+fDmg27RnWGj
TLSH
T171559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3e3cc229f4843f663e02ab52e290b71bd07b080f68dcd839698d6e417f8b69bc
MD5 3087d5769802e84eb5ce97b078a1096f
SHA1 8f495e1e34c619472734ae5529dcd84c315bd02a
SHA512 6f82c3aae080b047724d8c24565f19d945b7a1f338fa9c77589a1638276a70ad6146cb4725fdbd7798147c8effbf7332b027004f7a77c94d4d6dd14300163469
SSDEEP 12288:X95Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:X95sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1646523BF864C50CAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 592ccd60d5f3b2aa7998710dfac2e1a40cb797cd703cc012cf843cc37e6e344b
MD5 aea28224f7c180e8dd0ab865fba080ac
SHA1 20a121934cdc76742549304c70db96a505242b4d
SHA512 fc8db1a57881b284beb98ff0355a8f98f4ebc20b332c200b198a7c78f8f299fc3307c4d2089b3c482fd025aeb764380817d011c950002f32c5238a17c25b35a9
SSDEEP 12288:5eBNUbTVO86UyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:5JIUysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD85CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c5a7d51bc5f60dbc323ddcbfbe2997ee9ebfc59766d8e09fa7bac0376c2d2247
MD5 94bb48d1375e569db2ab4792dfc4269d
SHA1 8a28989938615c8ad4a6525b5a7cda392154b51b
SHA512 6d0bf6212e3a6b728dda66643a312a42d17ba1b5b9d9181a08d30e3a89801287a657097185a49e60694b2a8ecb2ccfb84da3220a1745978290f7fb587e3a9a51
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:FQvGAdlCEL8c/DRNw5CXD527BWG
TLSH
T14E266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 8143944bb9997bcc468a5cea65fa3314505623fb9ca364a46832bd7d29e571bc
MD5 433c0f635f13337d9571ea8e168fd2aa
SHA1 392a50a331c8c923619a9073d083a6f48ba938b7
SHA512 f6cc2394814c775e2d6cd7534049d3f2369748e4a8275c49acc58ee368c2a9e9241d484419b8eda7b433f20692d9c8b3febb96c82640846c8ff0dfc8a4cd41a2
SSDEEP 12288:XAwSfxL/2Dc3DDLLmt0LDQewsAjoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:wSewsAjosqjnhMgeiCl7G0nehbGZpbD
TLSH
T14085E031FA74E036C77B0DB60B76D71A182D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd978ad97fd6fa1d7662a66fda017f066994019e0c8aa93b7678d644c2dc64e7
MD5 fb0d8f72efb3d4d460bb382f115bc77f
SHA1 adaad5c82faef9145bd695435ae838ba17ae0a3f
SHA512 e455386def2367589262fb22ffc921271681437c8aca260167a03ca19e53ef8ca9bd693bef081341950b99eb1e6e2924c5adf0f933ac6cee1431bd9bf5bcdd6b
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHMVQBWG:6UEtQevvqc2W1cpV2tI32TB
TLSH
T14A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b8f3ebbb87190769ffefabf3da407725ed9db5e58034e68d3f060e6fbeb86aeb
MD5 6c46167b6750f6d5f848a62eb8d0950e
SHA1 b1b2f5213267515bd08924e8d77b239fc4499bf2
SHA512 34c174aacf6a0da6abd4a1d58fd37e08885c24d44fd4ab9dd27c7101fd2ae268eb521b294363422224299a7796846109f9d68d88f5d39cc0e9c4506a300b70a5
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/z0Dmg27RnWGj:loquVjnmrD527BWG
TLSH
T111D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 203f6b1d6294dac6758b43fb394a160e57df171ea65d8ae88a2903ebcf826f33
MD5 584a2df32785f2d37145872ac1a242b3
SHA1 fe5b6731e74dafdaca46f390a92e6d4914bdb555
SHA512 f1128f3853634c8bca9c44e296a1cb25c7c80c66609366510faad5858580f9c98f54450ff933f2682653b51f934e3deff0f31874c1ab724eecdb39581e4c16a7
SSDEEP 24576:SAhGL3IFoiwtA5l7S533sqjnhMgeiCl7G0nehbGZpbD:SAMUFoiq57Dmg27RnWGj
TLSH
T17C359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fb2f687b3fcf108e1f346d98953fcdb6a577c4676f272a9ac83a31d54db98877
MD5 f85e8b564dff2d5063d09128e7843c03
SHA1 854532aaf1a08e01c43585caa629ec0d87f76213
SHA512 4a52fe956e657a3741d1d570291e407accd662586df8e34c3103b21b59f22f9efc49f523cab8d49ab311c96e21f36b33d03f5a21b6caa42f29e2c53d5106e000
SSDEEP 12288:rmw5HEjsChNPBFgl0WDm+CjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:qwuWOWcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F85F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 336494b53263d3d7326e7235b18b6d039050f51fb83e47a677145043d5b0f45d
MD5 3919e59b555f5107631860a1d130b750
SHA1 1e06795f2dc2f50aa1b1ebcff5648b3ee5cbd0f8
SHA512 88ccfeb0b1e352979c5418bf23055ebba46a305e02a83bbbbdd19cd3e5a5df0f348ace28d0c754f0fc571b7645628f14c2f58c974e3f7613564810e7b9cd3eaa
SSDEEP 12288:S0Z1Iy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lZuFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1567512AE239820FAE163417CC5E5D609E7337C52673043CF166256AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 000b4220cca7f0b05846c189702f46bdf03fe83193a4c8971d2c2fa67fa8e58c
MD5 17688995c6f2894ca0686f2e9e5a7dfa
SHA1 48cb940fcb256dbe9b61f4998a583e0da10ca09a
SHA512 73860384d1f8452108dce1bbef399bdbf291040771188216fc561db82514dfc9684695406ef60b63c7afafb00c47ae0e203f5e0f9ed8633b8528bccdd71bbec2
SSDEEP 98304:4QRQyi36YOcPbLvw2gAf+PN36D527BWG:vQyiKa/X+PNqVQBWG
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eb49f703a6dc5a780ec6b8873151999ebe44e0dd2e7226667cf0af93563b7500
MD5 1267beb62398dc6c156d86db7835cd94
SHA1 69e8db9aa31cee1eb8157f3e67e37ddd6c41bd2f
SHA512 bb3f9909ce4bcbbc7d25ca51a283ec0f13585dd91bbc201cfbc4d98f47c69a382f6bb58ca2c7f82ab686647a08419a956329e60ef891f9ccd16787e0aabef1da
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN36D527BWG:CQyiKa/X+PNqVQBWG
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 87dc44988172174b24bb3e69d355e1dd7f5ad01845d529a81fcf4b639963bd1e
MD5 4ef441ad614a926db51ec28eac3dd279
SHA1 5fe9e1ef5b0518132a6c4027f20503f6c0ff1f5c
SHA512 d239b14f204ae7c3db66c63949a6752f5718e2acfc0e3d0cf047cce744b947afe07c788476adf3af5faae6735b7910b4c913339849757b1afa2e1a9e9d01b0c5
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL01sqjnhMgeiCl7Ge:368Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T13FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b3c6e73e070fca65fc7c72295a92c05f1a149703cb1b008f927e384d61fda88
MD5 34187b4f6e811e25101f4b99fcefbb6d
SHA1 96e7ef4f2646fbc7ce7aba599044d407ea46a86d
SHA512 ec74b482eb58cd57db8596ea1d5ac99297de60af7259ed58fc6497dff9d779d1ac05c88aa6c3df7dbbb5f14d5a337ddeda5a4e6c6fe8265d94e1f0c279ea411d
SSDEEP 98304:cy5112gYy5azzVvt69nLKnhZ9D527BWG:dLIHEWhDVQBWG
TLSH
T15C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 af4c9094e778604f2bc84ebb5735617915f69fd62e0c7cd22d25df00271c547f
MD5 8e097f618e55c4b75cb99d6677499230
SHA1 ea1a7108bc2c881f1d3f6934085609d845ce9f1e
SHA512 8ea38e10369152f5acbad77c8b6d86e8369a6bf8b4fbfcd96ac30486338825d9e7a0d9afb1aa52bd40bb0cb9cc5238fc5645a9720597c2af4465dc73684f60dc
SSDEEP 49152:oB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:iu6Jmdxd2diD527BWG
TLSH
T18BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2d979163b87cc74d28e61bef1224448bf37939fe2391de88d86ce61e0262fcb0
MD5 f0402cb789e6cd3523467b26ef31d84f
SHA1 a38e426138194908326d49bf4bf44720ac4fed64
SHA512 9328539bbce83d5c2098cd5ceb4f833cc9a0d228cd5ab36ebe5e0e2daa39bbb6dbacdb82988b5dd55d6056cc63be1bb919f160a70c35c4942d4764f9b0badbfd
SSDEEP 49152:+1hpsNoJpF1A63U44CwH7R4xWDmg27RnWGj:+mifPWRrD527BWG
TLSH
T127B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbcda0278bb9cf0eada2d93d285c40daa32b758b9eb19e7ca3b7c6a02dd0a630
MD5 d9f6e3476903073f299ba32d0a18a553
SHA1 a0cc4b434c04719e4aae8c7c30cd935eb2210d3f
SHA512 77252cbe7c2605104a2b4a85a4383f8185d0771eb5951257c06f462bde6a1a151ae2e3a3bbf6c2240ef8d0a4451942f13170930ea761ce69a46b24fdecaae500
SSDEEP 49152:KSuZQIY0Be2KcRVtOnks6NMHq5Dmg27RnWGj:U5dKii615D527BWG
TLSH
T122C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 45d7ba4b352dd8008eabc83095fa54c321352273335c3b3ff273f540e60cf70e
MD5 7b95fc9726ddab98e55b6b933887364d
SHA1 8bf901358a031fc0a89359707b29439968c88066
SHA512 3837faa67d0db7a8d6b45151ba45f49575793145575349c7f579f0382dfe46d70aef2d060c2a6c8426748eaabf8b10f5802981dd87d0b91568fb05c90fc24e9c
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5wyDmg27RnWGj:oX2imphvD527BWG
TLSH
T12895BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f1b6e10bfd1ae016a1399493dfa200a630ec89d8e14991a22c82551c2d089d6e
MD5 f4131274ccac363c190d7800a0494eb7
SHA1 3cef116d8d226f2210710eba28617e08441b83e4
SHA512 5ef9bf1564fb49a5f62695196d0a171bfd8b5616564b32400bab3c9cf3a26067866166270bd80e5497336ea1601fb6f7fa5e17da8fb00d708f91ef5eb0e7245a
SSDEEP 12288:3RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3RsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E36523BF965C41CAE52648B5C3E5F10EAC073E5BE92004937A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 df8b571b2909e9328f3f58c8165b3a812c8387d06f3d0f40f9648184c238a98e
MD5 0d99efc5c63b47beae924fab20025948
SHA1 2f8df61e1418bbffde32c6afe6fa4e04d23fb0fd
SHA512 af0cf321b13bff39ebe52e6132ea92320ceb7d0df7f0995489400a115bf2cd058f51795e3ee461aca1119deae2b5f129d9948d0d491039e782dcdde5a08c901e
SSDEEP 12288:mEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19F6523BF955C41CBE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 5f35d4eaccdcb3d79fb873ced3b32ff402a17c65650f98313813d52002972f03
MD5 29083f644bd554393c830c091c870421
SHA1 cf9329d8ec1aa7171ab6c1dd3db73381b30de0cf
SHA512 a2c7b25215fc8a89f24935ecb1fbf713501750a37864447920a5cefb52859301731d4c4af61572cee8da9ecc91619d8acbab29e634c26b0c283a884c4ce92b4e
SSDEEP 12288:AKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19C6523BE965C41CBE52608B5C3E5F10DAC073E5BE9200493BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 814adbf39de650f604d50ca6071365193216a5de9d0d7e7665508ab06d6af2ae
MD5 1cecf06fd92fcde641c085e070176612
SHA1 d6b42885b73513eaa19968d4813d7dbc59b0af5e
SHA512 feddbd41c0bf4231da3fb15970e8fd1631794ac8a562a2964df05314f801a736f97ae014f358a8160e8dfc26ca4f3cda63220a6432abe9dd0394a6333ce8786d
SSDEEP 12288:XVXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18965236F675C00CAD83685B4C2F5E11DE8237D96EB3005DB6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a484e006b84307683e274b0efa7a59e9fcbd2dee88714c163ce265d615a46957
MD5 d3a7c30648557fee3b0f61c0d5e4f6a9
SHA1 3ef6a546f2e74c587e08ebfcf847d97edd2ea89e
SHA512 ce409f80a9cf3bd6bb1615abfc193da219f58f163b7efda999efc305db88dd103d762b0b51b45e65ff067305456d1f89066830713a8d95a13e8d62b19cbc97e3
SSDEEP 12288:a/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:a/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1346523BF965C41CAE52608B5C3E5E14EAC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 b4f06ac42049a54fb62da46a509e93c7450ec8fc90f4e409c18bab8643288e21
MD5 e220ae73ec590f454c4e04890f2f6536
SHA1 b60230e5e6d736baa08fc73034cd3f65c282bc5b
SHA512 11f23fbb6b5aa401072f74a02ae93e721a40d08e3c0050d932e4ac694c0761782b9446f975a17d4ed80e6208bfdba6c0afd6713bcd42f206ac38785d54036418
SSDEEP 12288:3gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B56523BF965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 dc96439f41df8e9fce84648a4fc61d30b90803dc955a648f4df5df1f9c37d7c2
MD5 4276fe16971b371ea89c09bee50e0544
SHA1 5d902fa1b289d9efad3f7c96432f1f2cfc30a5a2
SHA512 6f74f62ba617fbe31e87d8c3b6fa4036a5d259478acc64024d771cdc47f323a92ec6390162cf8632d7d65ed6fcf011f8a80c5c1efc94be83c7784e24e5171fbe
SSDEEP 12288:bMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1716523BF965C41CBE52604B5C3E5F11DAC073E5BE9200493BA67BCBAF7B14684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2467e8166b63c34c9d1827201c5e2b38aa84719c61679fbfc4cc0f730578efed
MD5 c8d04a0d57649a790c999890957f8e84
SHA1 9ca905b9c3dcd28b8094b22e6f9abcc7362f506d
SHA512 98360e0a47d8c4ad01ebc52e4be04576a4f0f6b3d1466d972c21aaca1fa87008be87fa2c77d7475f5bff97ef1bddb18116ba562a6ac58aa4d7aeba930d514415
SSDEEP 24576:wZMrzFVSOksqjnhMgeiCl7G0nehbGZpbD:wZMrzfsDmg27RnWGj
TLSH
T1EF8501A9B35418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 a68894577e2c0ab95966c4c55dc0a83e52fc62384b963e13a6d6e2bd6ecca7f6
MD5 75453450599e8a5c0ece55939d8b1aae
SHA1 3faf7d54b254f6f4cd1d71e0eb92e519d20d459d
SHA512 5bb8e098668d6db735924f65e5a8ce974b079a9ee588b32385c07f521dbadf01bea1c92ef409711970d36a1ed038110a6057ab30f1cbea1959bbf851c558ae6c
SSDEEP 12288:hVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1306523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7a2f69124b4ba2b228c49a169a698ab8d216ff7f6ce2aaaceb0328f36c1a43b5
MD5 e9b9c57a3ed30f150b34fb8e8fe9ebd1
SHA1 15f430009c41997bb8b3dc4fdbecd9e19b6df5f3
SHA512 b1cb82a1802ae8cf228b63b10f0b48f9ab1cfd776d8ed0f5c28ea8aaf9a95c06cda9744ee42476462b39ebebfecec5464dff8d04b5b288f9beb1aeb32fd4a2d1
SSDEEP 12288:iJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A26523BFA65C41CAE52644B5C3E5F11DAC073E5BE92004837A6B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 55ee4e6be33016d2189b23b937b96c028000dee7408aa848f6e55acdf5b7fbe9
MD5 98bee41d46b721c8ec7b75db170aae10
SHA1 b092b75b1ed762954845c0d0b77f2f4f3e520a89
SHA512 8f589bb2b08b3e171749947b842837085ac3cf7c0171420a12f4ce69b2fa8336e95f0b7b12b5cc0f562907fdf151dac1e1f5d9702aa93f66bf157886fc94625a
SSDEEP 12288:ByPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Qzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D75125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 f9838af97554e2d7d4cd4b6a150f8aab60867a31ccc56c38e12c439dcb21106c
MD5 6e5a2d43ffc410384a8ccb0a68e3e8eb
SHA1 a234c176e2054d4d463ddf58e492ac4d698f85b0
SHA512 c25da5bf6706547cdf71633b05c1a362934d40686f6c300fdd0ee96ebf0acb14ea52e345af83b0878784f1dfafbae2fee55972cf716a6d5c1e5131f4956a0fe9
SSDEEP 12288:uVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CE6523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 43298e6baedf57cc3a537313c855202af5321458aad4876551f2c2ae6083b353
MD5 a025fa1f6f3cba42f22de6082a77961f
SHA1 eb05a9c5f8fc8a98ed773eb82f4c1a55bb9b8a4c
SHA512 b9814f953fb765dfd599a89eb7945f3315c44ae2b44c115a405bcba02f60e7c45d0573ec7788de5c957233aa39dba03f1d1c4761ff210d5d7f0d5471ea7d8c94
SSDEEP 12288:FVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F36523BFA55C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 64c471a8ff61291548aca3f028d854c8a77917e008060808ce8aa932b2c42c71
MD5 941723dcdc24fcc7d2ff9bc07ce2a4fd
SHA1 7fd08955ab074f73e5f54424cc0c525fd48938e6
SHA512 236c78e32e7690c5f6bdfb22d1b40a942fa822b1586457365b69f744fb288cb8034a0e6ce28b4a1d462ceb15d06ed85656fe0b6dbb03550e7e19195f56bfeea8
SSDEEP 12288:WyPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D975125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 bd99fe8b21f8eb978284537751c8d3846e2e496f84e37e73e3b3b4c526466120
MD5 7b24ebaa64dd5901cf89ace7f91af1df
SHA1 0ffec451ec16de86880a7715a3fd6fb3a3b98cac
SHA512 840470a53975f532ca69ee3c6221d9636163d6bca5b7227e0bb8b84561022d3ebf30cf94d10f38ee015465d24cf434136125bcf20ee5b61fefe714dd34b6e889
SSDEEP 24576:ZcP4mcvIjkGOxhKP2l71SNKbrh/8KB9sqjnhMgeiCl7G0nehbGZpbD:uP4m4IpOO67N8KXDmg27RnWGj
TLSH
T18165BE2DABDC0096D0BB917886658A49FAB1742A1F3286CB1160933D7F77EE44F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3fea9fb33d275fdf56dd37877f8ea6909199e0cdf3c823b2924707319d2bf62a
MD5 af8d2da45a71464bf510e044a6cd8895
SHA1 d2d0d49067b6de6564f11e3f1ca6cf0cc7d39329
SHA512 e74de12ee546789786a1f06c906f999b1e2e48bce1a52bd0bd0748e271160aca613f5b5ad18eed4c878ab29ce343ddbd475275ec459ef7212b3eba6f4402b6b4
SSDEEP 12288:6VsfFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11675011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 23b6b9c9b608a06ccdac3fdbfd30ab576d6a15345f64a54fa359fddca8291d3c
MD5 a404855e5bb39254b651ae42731e191c
SHA1 6971b7d90cae8a94abd2b1e06337f117faa22cad
SHA512 cc73414e6d48fc865968f00f70420bc35804bf89e41082121fbdc8b0088818c40afd01c5784e0d7137a2921992c1d7050209c8929891b1a7b1cd84262d7bcc65
SSDEEP 12288:IlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C65237FD34C518BE57659B082E9E02D781B3E669E204483BA4778FDF6B08948F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 eb5f560a7320bbe3157faa21a28cb3d243fd294cfaa27d789b2989f1a246068b
MD5 28d728694824be4a5d3db769de5e560b
SHA1 9bbccebc07314d818d13fdc5c4de83beb3bc7c13
SHA512 641b8c926f0bfc75e38704e0a8ec91e30370a8dfac65c1887cd16e336e5507f33d8e000c20cb2b902c8b75acaa9e143842436d89258c49d872559d81f6207138
SSDEEP 49152:ra0h2GEkuAe73q3pp46zwwQjDmg27RnWGj:ra0hNYG4JwMD527BWG
TLSH
T18085AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 e07b15e82a9414c6e70c98526316b0cdbe8552063bd643cd42bc2966c2188b14
MD5 e049c849ed40b4bef5ff9413aab865c2
SHA1 d1f56f5c3a68b3ac066be145b6b5c7197e0c8b16
SHA512 e858d83bdd4dfee59a2a76595a8614e8da5b9abcdcb3dc6119dc05874f73f88e5e1178e7a5064dc24dbc6ce1ffe439ebf31d1c6027acc5467b10ac4b0b56198a
SSDEEP 12288:7hbHjfX0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7hbHjP0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F875127E12AC20D9E57291BD8296D10AD632BC26172053EF23D281BE5F37DE44D39F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 97f8b35e002ec5db37db94a564b6bd457bcabd7caf8510c4d62d4252a7aa1284
MD5 930cc55ae5c993728a81bf069f1ef08c
SHA1 28b2225cfeeba87294607fd6569c5ec8a89a208f
SHA512 2706e05a9609fc21fc62e1240b20b737d11336a26cd5ea9d47f02c6d0e569b71f61a9cbad0c8f958a0352dfb63bfe1b9c13cfa5991e59dc7f89f6e96a3b91253
SSDEEP 24576:i3YgnJcRTk4yti+R5dpR/csqjnhMgeiCl7G0nehbGZpbD:iIgnaTk46ppR/IDmg27RnWGj
TLSH
T11C45BF2EF2B910B9D8A6D136850147B5FB71782D1F209AC70170C538AF1AEE85F39F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 709d8868e3bcedc9af4f2d87ff8663f09a5b6831f11978d9d927a57eb75b0187
MD5 559f3ce11d84f5ed408776f0854b9665
SHA1 d6c4dc56ecce39866dab9d7dc111b62becb2296b
SHA512 7edfa828eeead2cda7c35bcb6cac87c6dc6c73def84ee04436cccd96ea5e8c000d221f37951d32c44b3fe6e799a0c50e20b7ec6b9c8abaa081b477396073b05e
SSDEEP 12288:4ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C6523BE924C51CAD93649F5C3E6E11DA8073E56AB2004D379A77CBDE7B18E84B38413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cba724321555f321219e4fbed41a02aa908fb896a54d3733cac62f08546559a2
MD5 b57446ffc476e195725eaa6133518b83
SHA1 4b071a16cfa89a7c97f5dd847a963e6aa26977d9
SHA512 1b0c6ca25318d18a9bf9d37e84bab688b9ee41dbeb7d829174dcdc75a83535074431ffff0ba1b55be4fbd05150411b1523bc9e22f7b4b8bd7b326b9c30f5f719
SSDEEP 12288:0ObJA4LWOsvAYFTeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9L:ZdL3UTesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD950159E79800F9E87B813CC5A2D616E672785D0720E7DF03A94AA91F637E04F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 790aa6643103c8a8b617a201f6f7344ae4af4a730af5417e36b425317ecb0f78
MD5 5422b586a89c6756b56ebcb6b89613d8
SHA1 fc19a27543248f5205f8aebcfa256e4d4f8f97b8
SHA512 92991a71c31da1685a86a6fc6618eddb8391424f1d95f4cb3559cd78c6f38d78bf3c66209400ac7f401fc66eb401217bf549408c2141173e42724dc46fb3b183
SSDEEP 12288:gpFtyOSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9OSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C975022E33EC10E9E536917C8692D20DD6327C66072117DF06D184BE5FA3EF85D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 91a3d6046d75a83182b64a40b454a124b0e9ae81f130eaa40dd87ab2bc2d45e1
MD5 5257bb861825bec27088ec59396e37b6
SHA1 f0b3f86bb8de3c66afec9fb7c23dea82e8b10b1d
SHA512 24c53871cc487b53710ce0ce79d86ff23b8fd25d766e5cf238856b8b76b95c198ad042ed94500d4403f74360c2da7523edf66874650012331fc0aade2a7561bb
SSDEEP 24576:i7NM9YmZqmWMUkPjZM48Mv6bEhsVsqjnhMgeiCl7G0nehbGZpbD:i7cBWMpPjN8DbEhwDmg27RnWGj
TLSH
T19B659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACB1162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 541cc203edb0ed07ba665d3bfaff7b394ba69b350bae0eb91356c15712052e5f
MD5 3600be11a2fa3213f54a5f9aee92bd35
SHA1 c8ae02276f3f6d6748fc16b93077b5e2db95183f
SHA512 d5168db4afb94d5609d49c96e349e004c1f30100ac2bd34d387aaabf2dab5cc0588892ad80a3f8a155b20805a319d583edee26eeaee8a3560f02b2207f524523
SSDEEP 24576:yW6BApg2YuyuNDYTabvcRvNYf8km1rsqjnhMgeiCl7G0nehbGZpbD:yF2YuHNETovcvNYf8kmpDmg27RnWGj
TLSH
T1CC857E6A27ED80A4E0BBD27D85B6D246F9B2B8511B3055CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 633d55218624c0e32e605c39318cc77ec76c2dc9371a2019ffcfb02290d12751
MD5 313c1323babe0fea828aeafd4e8afcdf
SHA1 6c8b7f8dec3a0b52ea0c5d41cef9db83f3b9c42d
SHA512 1701d042adbd02cfc113733421463d96ad63e30c456682ef886f8bf097b130abed1c7d3e82a1a9b97693f1d3fc50f19ac00ee5f242e27026b72ce9c1d1b36178
SSDEEP 24576:dAFs06+OmlfkNXEbToWsqjnhMgeiCl7G0nehbGZpbD:SFs060lwXuDDmg27RnWGj
TLSH
T16E65BF3F62AC00D5D07ED17D8A97C91AF6B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 5e017c62073214e9baa8e8e5e8a09018093a12aa4352ad08de77ec697c892aed
MD5 fc51c834d123e43f851fa805b0b738d8
SHA1 210d32378abe9e91c4639ee9cda6d38ed68a12e9
SHA512 ebe06624b4226440faf83bde71ca70cfa0efb9bd0f10d423aaa94db912ac1a953a5389f769e3850237cbe0b7a08ed61244e7212783e320887f2f7f74fccff73f
SSDEEP 24576:CJnJ5D3WLfsqjnhMgeiCl7G0nehbGZpbD:CJnJ5DGLDDmg27RnWGj
TLSH
T11385E13DD2A810E8D4B7C2B4829A5746FE72383D2F2169C728B4D5357F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 38d8cd4963d00fe23fcb5eabad8933e98609fae5325e8f99208018921234cfc1
MD5 04e7f8b6853c8489470f92c8e2214be8
SHA1 54cf100acf03bb85463f22822fd240e330bd37a0
SHA512 e67b01709e049f4c1664324be701d03ee4080fa99d0daf030ed7ea8ccba5e42b62e18ae74006759ea867052246523b14a151ce7e7ae049045d345a753fddffdf
SSDEEP 24576:oEPohm6/7IIXdwcXrif7qQncjlP65i3VucsqjnhMgeiCl7G0nehbGZpbD:Ho06DIKdwc+eQnSt65aVlDmg27RnWGj
TLSH
T1B0955C16B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 1f72fbf9803ccc6548ce40b7e4b5f5d982ebea4999d5eb7d3e7126fb02b4bdb8
MD5 7688d7debb61066f6357f7964d703dff
SHA1 53feb223c736fc7063da802b8f70a4af7b1bbe66
SHA512 124834160be8d16bada68cf20bb7a3200062fda1bc27a94e26ba644b98ead672fe77e8324609feb01c0e780e017c1d1f24d65e59f48f928cc19fa9fc21ad9358
SSDEEP 12288:IEP3RBjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jBjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16175126E679C60DAD136907D8291C209D733F4716B2127EF26A2D57E8F739E80E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 8b21d1341e276586dc00177c107ca707b0ecd159365a77610bac72625469e032
MD5 9972f73f461b60ae27bf698323520c8a
SHA1 528c4b18790f89aae0d9f24a360205d0bc67fe98
SHA512 18a1428c5848d83da22d31b0004f66dafdca300e5b5427cabfa213112035ede13b9e9402969cbadc3fe79e5f2caa00b1756e2e474278e8f3ebfe9510fd85e228
SSDEEP 12288:6jkyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6IyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A751219639C60C9E9760578C6B3D1589C36BC319F2046DF6191FA3EAF72BD48E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 a3b0de251bcbde234543c4a7eb8cc955307de79a3cdbef1eda6c9605e6cab9b0
MD5 c9016d43ce7ef3d2de3bf97bede7ba1c
SHA1 48aab594cbdb3f71effcdeb65885fdaca0904459
SHA512 3830381ce82c5ba878bc362dad11ec461d94d039a0ddfa94e062ec40081148bfe77479fae051e1c24e38dd847f72de517b8eb7d326dd3334eb910d8799ce4b69
SSDEEP 12288:wriXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wisqjnhMgeiCl7G0nehbGZpbD
TLSH
T13065237E525C60CEE93245B8C3A5E51D98133D766B2018E739E3F8BDEBB24D44B39812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4525805f5173f531a258ad688aedecee94d06df7572da1947fd564b4793ab3ee
MD5 1716f49dc1af7391f2d941aafcf7b686
SHA1 159350ae039b6e29571e5e90dd1a557be025c88a
SHA512 1cf1c8d056affb8f5786f62b73589b9916e736495c7227ce72db7a8a78cab1358753bcee614f8109abed63f54e35faf418dd5e8bdf57d30496664d1c8a18fcbc
SSDEEP 24576:kQ9MxZKdcz97w3tsqjnhMgeiCl7G0nehbGZpbD:kVKXRDmg27RnWGj
TLSH
T12C558C2DABE9058AE177D27595A250C3A633B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 8dfd77ea81d3ab5f6c2c043f7953c4e0074b2066530e14ec96b3b24183a0535e
MD5 155fabb7ae328081699094796f9b375e
SHA1 a2786ec9bcb2d97a8ded8db9b54640956ae90056
SHA512 b690e91cc75b1f7eacb2fd45bc743dbf01708248231c9548671afd03e0dda93cff2bd7b5241ca78392667f55184f89b86c3fc1eda760f3e347c3041c64e0b002
SSDEEP 12288:WyoKo2hRple9poXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:WyocbAposqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E85E01FB76D40E2E176813C8985C249E673B4305B6157CB6692C73D8F639E8BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 ebc417a85f8512f148a9fc523518f1ab9c7ff344071b07a42be9549dd549c848
MD5 53b74d0c6691c344c6b760eea841abf1
SHA1 e48276beaad2960ef0dd152eb65f6648ecfe8452
SHA512 0ef714546b2dfc18f0fdd0cb736f9f973b28bcf1c2b13cf1bd37562a530f33468ecb3e0c1937d5beb6d3b87c05659b20f65f8920c5e95654d198001489258cc2
SSDEEP 49152:cWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKUDmg27RnWGj:W0zuNIYD527BWG
TLSH
T11CA57B3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 14a2ecf35c91b7498462a081dfcdd53e461003bb8532137521fa82513b51144c
MD5 c5c6bbc07463c61d1991427d39aa981a
SHA1 0a1e5c98be7347d87385521701ac7244c0096048
SHA512 fdb86024f7fa11fc60226eb52b75cd6362087936fd9c77e8efc36fcc7f28b9b0ce3e977ae4a472d7aec217ab90b3c72d34fa470d2b55b9b1c47cadfc0c531e11
SSDEEP 24576:w1QT7EcpfxR+N5AWAz3ooiYujMqbjsqjnhMgeiCl7G0nehbGZpbD:NTDxR+N5YzT4jM2Dmg27RnWGj
TLSH
T1A855B02EA7F815E9D17E85798B23C506FA727821033193CB42A0C17E1F6B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 e9d388d64ba69ecfc0ddfcfebe404a10d351b1d41ac8729d1195883cb25193aa
MD5 ec4fff13bbe854f94ab4cd916d194b46
SHA1 be90d2c0c00433b54c9d9e088e2716965dde46ed
SHA512 a8507ebb6a35bdb1b07c8b3590512f217b479b8bb1cfc5c516f3be9d50b976588494d448f195f6b7415ef0c30b456d7a59d12fee01c22ac34394b4342059ac21
SSDEEP 24576:XTMdOz0FFS+JmSLXsqjnhMgeiCl7G0nehbGZpbD:l0K+JmSLrDmg27RnWGj
TLSH
T12285E17EA36D14E5E47BC17CC653D90AE9733862032166DB0690C0B97FA7EE47A39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 2770939c750f57b7b76a70b120d3f12c34692da22d39c94b20ce7ce4839ca5e9
MD5 ab1b163f5f06d6f1d053fad52b448793
SHA1 20b45c85b8cb187814bdfffc47af4209462de38e
SHA512 07ccf2fd3d1c0c84da4954fc9e51918567de144ba35a3c8cd7734d7202f874995b37b2e1e0a37150e0b3024c6412fb3e7061fca58fb534b3274ed7cc92781713
SSDEEP 12288:m4peXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D175126E63EC30D9E4325574C2B6D1199432BC36272019FF39E1D9BE9F729D48A38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-0-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/820-8-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/820-77-0x0000000000400000-0x0000000000644000-memory.dmp

Download

memory/820-1-0x00000000023B0000-0x0000000002417000-memory.dmp

Download

memory/976-20-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/976-12-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/976-89-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/976-21-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1104-197-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1104-353-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1104-200-0x0000000140000000-0x00000001401C2000-memory.dmp

Download

memory/1320-138-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1320-141-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1320-251-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1320-132-0x0000000000630000-0x0000000000690000-memory.dmp

Download

memory/1560-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-173-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1560-66-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1560-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1716-276-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1716-174-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1716-175-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1716-167-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1772-123-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1772-34-0x0000000140000000-0x0000000140189000-memory.dmp

Download

memory/1772-32-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1772-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/1852-56-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1852-155-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1852-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1852-50-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2096-109-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2096-212-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2096-112-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/2204-452-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2204-454-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2204-263-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2204-150-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2204-143-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2272-81-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2272-46-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2272-38-0x0000000000530000-0x0000000000590000-memory.dmp

Download

memory/2272-83-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2272-37-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2628-120-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2628-218-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2628-124-0x0000000140000000-0x000000014018B000-memory.dmp

Download

memory/2628-114-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3420-250-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3420-237-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3420-230-0x0000000000540000-0x00000000005A0000-memory.dmp

Download

memory/3420-468-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3432-216-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3432-211-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3432-208-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3432-202-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3432-213-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3600-210-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3600-93-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3600-98-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3600-91-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3928-473-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3928-260-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3928-264-0x0000000140000000-0x00000001401A6000-memory.dmp

Download

memory/3980-310-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3980-277-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3980-471-0x000000000D0E0000-0x000000000D0E8000-memory.dmp

Download

memory/3980-476-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3980-278-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3980-294-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3980-268-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/3980-274-0x0000000000650000-0x00000000006B0000-memory.dmp

Download

memory/4272-266-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4272-157-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4272-163-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4272-156-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4556-324-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/4556-180-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4556-186-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4556-188-0x0000000140000000-0x00000001401E2000-memory.dmp

Download

memory/4592-236-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4592-130-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4720-480-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-489-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-494-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-495-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-477-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-478-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-479-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-481-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-484-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-482-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-483-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-485-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-486-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-487-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-488-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-493-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-490-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-475-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4720-474-0x0000025B268C0000-0x0000025B268D0000-memory.dmp

Download

memory/4964-220-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4964-451-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4964-219-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4964-226-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5000-88-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5000-86-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5000-79-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5000-71-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/5000-78-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5012-247-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5012-252-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5012-241-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5012-470-0x0000000140000000-0x0000000140216000-memory.dmp

Download